CVE-2026-10706

{
  "id": "CVE-2026-10706",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T15:16:25.287",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties."
    },
    {
      "lang": "es",
      "value": "En el creador de aplicaciones sin código de Adalo, (Versiones 1 y 2) los atacantes pueden extraer registros completos de usuarios y correlacionar el comportamiento del usuario a través de múltiples aplicaciones mediante la enumeración de dbId. La plataforma no implementa la minimización de datos, la privacidad desde el diseño, ni implementa salvaguardas técnicas adecuadas, lo que permite que información sensible sea expuesta a partes no autorizadas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Adalo No-Code App Builder",
          "product": "App Builder",
          "versions": [
            {
              "version": "1",
              "lessThanOrEqual": "2",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-09T15:13:39.000602Z",
          "id": "CVE-2026-10706",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://kb.cert.org/vuls/id/849433",
      "source": "[email protected]"
    }
  ]
}