CVE-2026-10706: Adalo No-Code App Builder App Builder

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.

Affected products

• Adalo No-Code App Builder App Builder: from 1, up to and including 2

Published 2026-07-08. Last modified 2026-07-09.