Executive brief
Adalo, a platform used to build mobile and web applications without code, contains a security flaw in how it handles user sessions and data requests. This vulnerability allows an attacker to collect sensitive personal information—such as email addresses and unique identifiers—from any application built on the platform. Because the issue exists at the platform level, individual app developers cannot fix it themselves, potentially exposing the data of millions of end users to automated harvesting.
Technical details
The Adalo database API suffers from an information disclosure vulnerability caused by the use of long-lived (20-day) JWTs that lack a revocation mechanism. These tokens are visible in client-side requests and, when combined with a wildcard CORS policy, can be reused by an attacker to query the API directly from any origin. By targeting specific components like leaderboards, an attacker can trigger over-fetching of user records, retrieving emails, UUIDs, and custom fields that were not intended for display. This allows for automated, cross-app data extraction without requiring application-specific secrets or complex authentication bypasses.
Affected products
- Adalo App Builder (V1 and V2) All versions including V1 and V2
Timeline
- 2026-04-03: other: Vendor notified
- 2026-07-08: disclosed: Vulnerability publically disclosed by CERT/CC
- 2026-07-08: advisory: NVD publication date