This vulnerability (CVE-2026-10708) in the Adalo No-Code App Builder involves insufficient protection of credentials (CWE-522), improper validation of tokens (CWE-346), and inadequate expiration handling (CWE-613). The combination of permissive CORS policies, long-lived JWTs without revocation, and a minimal leaderboard component that returns sensitive user data allows unauthorized large-scale data harvesting. Attackers can exploit this by sending a single request to the vulnerable component to retrieve user emails, UUIDs, and custom fields from any app built with Adalo.

The vulnerability enables unauthorized disclosure of sensitive personal information such as user emails, UUIDs, and custom fields from any application built with Adalo. This can lead to privacy violations and potential misuse of harvested data. There is no indication of impact on data integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/849433 for current remediation guidance. Until an official fix is available, developers should consider restricting CORS policies, reducing JWT lifespan, and implementing token revocation mechanisms to mitigate risk. Monitor vendor communications for updates on patches or official mitigations.