CVE-2026-10706: Adalo No-Code App Builder dbId Enumeration Privacy Breach

Technical summary

The vulnerability stems from inadequate access controls and enumeration protections in Adalo's API layer. Attackers can systematically enumerate database identifiers (dbIds) to retrieve full user records without authentication or authorization checks. The absence of rate limiting, input validation, or privacy-preserving data architecture allows adversaries to correlate user behavior patterns across multiple Adalo applications, effectively creating a unified tracking profile of users independent of application boundaries. The flaw affects core authentication and data access mechanisms in Adalo versions 1 and 2.

Business impact

Organizations using Adalo to build customer-facing or internal applications face exposure of personally identifiable information (PII), behavioral data, and potentially sensitive business data. Users of affected Adalo applications may experience privacy violations, identity risk, and loss of trust. For Adalo customers, remediation requires immediate migration to patched versions and potential breach notification obligations depending on jurisdiction and data sensitivity. The ability to correlate user behavior across applications amplifies the harm by enabling sophisticated profiling and targeted attacks.

Affected systems

Adalo no-code app builder versions 1 and 2 are vulnerable. Any application built on these versions and deployed in production is at risk. The vulnerability is platform-wide; all users and data stored in applications built on affected versions are potentially exposed. Organizations running legacy Adalo environments should prioritize inventory and assessment.

Exploitability

Exploitability is high. The attack requires no authentication, no special privileges, no user interaction, and no complexity—it can be performed remotely over the network. An attacker with basic HTTP knowledge can begin enumerating dbIds immediately. The attack is passive from the user's perspective and leaves minimal forensic evidence, making detection difficult. No specialized tooling is required.

Remediation

Upgrade all Adalo applications to version 3 or later as soon as possible. Version 3 introduces proper access controls, dbId obfuscation, and privacy-by-design principles. Before upgrading, conduct a user notification and data exposure assessment to determine if breach notification is legally required. Implement network segmentation and API rate limiting as interim controls on your application infrastructure if immediate upgrade is not feasible. Review and audit access logs for signs of enumeration activity.

Patch guidance

Upgrade Adalo to version 3 or later. This release includes fixed API authentication controls, random or opaque database identifier schemes, and data minimization enforcement. Test the upgrade in a staging environment that mirrors production data classification before deploying. Verify that no application continues to rely on direct dbId references in client-side code, as this pattern will no longer function post-upgrade. Coordinate with end users if applications depend on user-facing database IDs. Rollback procedures should be documented in case of unforeseen compatibility issues.

Detection guidance

Monitor API logs for patterns consistent with dbId enumeration: repeated sequential or random requests to user endpoints, spikes in 401/403 responses followed by 200 responses, or requests originating from unusual geographic locations or IP ranges. Search your API access logs retroactively for GET requests to user data endpoints with incrementing numeric parameters. Implement alerting on failed authentication attempts followed by successful data retrieval within short time windows. Query your application databases for anomalous user account access patterns or bulk export events. If available, enable Adalo's audit logging to detect and correlate cross-application user lookups.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (7.5), ease of exploitation, and direct impact on user privacy and data confidentiality. The lack of authentication and the ability to correlate behavior across applications amplifies risk beyond a single application. Organizations subject to GDPR, CCPA, HIPAA, or similar regulations face compliance violations and financial exposure. The vulnerability has not yet been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, but the combination of low attack complexity and high impact makes weaponization likely. Delayed patching increases liability.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication required (AV:N/AC:L/PR:N/UI:N), high impact on confidentiality (C:H), no integrity or availability impact (I:N/A:N), and unchanged scope (S:U). The score accurately captures the ease and breadth of exploitation and the severity of unauthorized data disclosure. However, the score does not fully reflect the secondary harm from cross-application behavior correlation or the regulatory and reputational damage from widespread privacy violations. Organizations should treat this as a critical-priority issue regardless of CVSS rating.

Frequently asked questions