# CVE-2026-10708: Adalo App Builder data harvesting via long-lived JWT and permissive CORS

Source: https://junglewise.ai/threats/cve-2026-10708-adalo-app-builder-data-harvesting-via-long-lived-jwt-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-10708 · Severity: info · CVSS 0 · Published 2026-07-08

Adalo, a platform used to build mobile and web applications without code, contains a security flaw in how it handles user sessions and data requests. This vulnerability allows an attacker to collect sensitive personal information—such as email addresses and unique identifiers—from any application built on the platform. Because the issue exists at the platform level, individual app developers cannot fix it themselves, potentially exposing the data of millions of end users to automated harvesting.

Technologies: [Adalo App Builder](https://junglewise.ai/threats/technologies/app-builder). Vendors: [Adalo](https://junglewise.ai/threats/vendors/adalo).

## Quick answers

**Is CVE-2026-10708 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10708 being exploited in the wild.

**How severe is CVE-2026-10708?** Informational severity, with a CVSS score of 0, published 8 July 2026.

**Which products and versions are affected?** Adalo App Builder All versions including V1 and V2.

**Is there a fix for CVE-2026-10708?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10708 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-10708?** Check whether you run Adalo App Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Adalo database API suffers from an information disclosure vulnerability caused by the use of long-lived (20-day) JWTs that lack a revocation mechanism. These tokens are visible in client-side requests and, when combined with a wildcard CORS policy, can be reused by an attacker to query the API directly from any origin. By targeting specific components like leaderboards, an attacker can trigger over-fetching of user records, retrieving emails, UUIDs, and custom fields that were not intended for display. This allows for automated, cross-app data extraction without requiring application-specific secrets or complex authentication bypasses.

## Affected products

- Adalo App Builder (V1 and V2) All versions including V1 and V2

## Timeline

- 2026-04-03: other: Vendor notified
- 2026-07-08: disclosed: Vulnerability publically disclosed by CERT/CC
- 2026-07-08: advisory: NVD publication date

## References

- [https://kb.cert.org/vuls/id/849433](https://kb.cert.org/vuls/id/849433)

## Related threats

- [Adalo App Builder unauthorized data extraction via database ID enumeration](https://junglewise.ai/threats/cve-2026-10706-adalo-app-builder-unauthorized-data-extraction-via-database-id)