CVE-2026-10708: Adalo Leaderboard Data Exposure – CORS, JWT, and Access Control Flaws

Technical summary

CVE-2026-10708 stems from three linked security gaps in Adalo's architecture. First, wildcard CORS configuration permits cross-origin requests from any domain, bypassing browser origin checks. Second, JWT tokens issued by Adalo remain valid for twenty days and cannot be revoked, extending the window of exploitation if a token is leaked or obtained. Third, the leaderboard component does not enforce sufficient access controls, allowing unauthenticated or minimally-authenticated requests to enumerate and retrieve user records. An attacker can craft a request to the leaderboard endpoint, receive JSON responses containing user emails, UUIDs, and application-defined custom fields, and repeat this across multiple Adalo instances without application-level rate limiting or per-app API keys. The combination transforms what should be a low-impact information disclosure into large-scale reconnaissance.

Business impact

Organizations relying on Adalo for customer-facing or employee-facing applications face rapid user data exposure. Depending on the sensitivity of custom fields, this may include personally identifiable information (PII), contact details, or application-specific attributes tied to user accounts. The lack of token revocation means that even after a breach is discovered, previously-issued tokens remain active, extending the duration of unauthorized access. For SaaS platforms, e-commerce sites, or internal tools built on Adalo, a single exploitation chain can compromise user trust, trigger regulatory notification obligations (GDPR, CCPA, etc.), and create liability. The twenty-day JWT validity window compounds the risk: an attacker who obtains a token early in its lifecycle has two weeks to operate undetected.

Affected systems

All Adalo applications are potentially affected by this vulnerability. The flaw resides in core Adalo platform behavior—specifically CORS configuration, JWT token lifetime, and leaderboard component access controls—rather than in individual app configurations. However, the severity of exposure depends on the sensitivity of data stored in each app's user records and custom fields. Applications that store minimal user data or do not use leaderboard components may have lower practical risk, but organizational Adalo instances should be assessed individually.

Exploitability

This vulnerability is highly exploitable. No authentication credentials, API keys, or app-specific secrets are required. An attacker with network access can immediately begin requesting leaderboard data from any Adalo app. The attack surface is large because Adalo applications are publicly accessible by design. The low complexity, absence of user interaction requirements, and lack of rate limiting on the leaderboard endpoint make exploitation trivial to automate. The twenty-day JWT validity window provides ample time for discovery, exploitation, and large-scale data collection. An attacker can harvest data continuously unless the platform revokes tokens or changes CORS policies.

Remediation

Adalo must immediately implement three fixes: (1) change CORS policy from wildcard to explicit, trusted origins only; (2) reduce JWT token lifetime from twenty days to a more defensible duration (e.g., 1–24 hours) and implement token revocation mechanisms; (3) enforce strict access controls on the leaderboard component, requiring explicit authentication and authorization checks per app. Organizations using Adalo should, as an interim measure, review leaderboard components, restrict their visibility in application settings if not essential, and audit user records for unauthorized access. Monitor JWT usage patterns and be prepared to reset user credentials if compromise is suspected.

Patch guidance

Verify the Adalo vendor advisory for official patch releases and timelines. Patches should address CORS configuration, JWT token lifecycle, and leaderboard access control. Apply patches immediately upon release. If Adalo provides configuration options to tighten CORS or reduce token lifetime before a formal patch, implement those as temporary mitigations. Test patches in a non-production environment to confirm leaderboard functionality is preserved while access is restricted.

Detection guidance

Monitor for suspicious patterns in leaderboard request logs: high-volume requests from external origins, requests from unexpected geographic locations or IP ranges, and requests that enumerate multiple user records in short timeframes. Watch for JWT tokens used across multiple applications or long after issuance (indicating token reuse or leakage). Implement alerting on CORS preflight requests to leaderboard endpoints from untrusted origins. Conduct a user audit to identify records accessed without corresponding user interaction (evidence of automated harvesting). Log all authentication and data-access events with sufficient detail to trace the source and scope of exposure.

Why prioritize this

This vulnerability is HIGH severity and should be prioritized immediately. The combination of zero authentication requirements, large-scale data exposure potential, and a twenty-day exploitation window creates urgent risk. Unlike vulnerabilities requiring user interaction or specific configuration, this flaw affects all Adalo applications by default. Organizations must assess exposure, plan remediation, and implement mitigations before adversaries conduct widespread harvesting campaigns.

Risk score, explained

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields a score of 7.5 (HIGH). Attack vector is Network (AV:N), indicating the flaw is exploitable remotely. Attack complexity is Low (AC:L), as no special conditions or techniques are required. Privileges (PR:N) and user interaction (UI:N) are not required. Scope is Unchanged (S:U), meaning the attacker impacts only the confidentiality of the vulnerable component. Confidentiality impact is High (C:H) because user records, emails, and custom fields are fully disclosed. Integrity (I:N) and availability (A:N) are not impacted. The score reflects the ease of exploitation and the magnitude of information exposure, though it does not account for business context or the twenty-day exploitation window, which increases actual risk.

Frequently asked questions