Executive brief
Adalo is a platform used to build mobile and web applications without writing code. A security flaw in the platform's database system allows unauthorized individuals to access full user records across different applications. This could lead to the exposure of sensitive customer data, including emails and personal details, for over one million applications built on the platform.
Technical details
The Adalo database API fails to implement server-side authorization checks and data minimization, leading to an insecure direct object reference (IDOR) style vulnerability. Authenticated users of any Adalo-built application can enumerate database and table identifiers (dbId) to retrieve complete user records from other applications, regardless of tenant isolation. The backend returns full records even when a component is configured to display only specific fields. This is further exacerbated by a permissive CORS policy and the lack of ownership-aware access controls. As of the advisory date, no patch is available from the vendor.
Affected products
- Adalo App Builder 1, 2
Timeline
- 2026-04-03: other: Vendor notified
- 2026-07-08: disclosed: Vulnerability publically disclosed by CERT/CC
- 2026-07-08: advisory