CVE-2026-10706

CVE-2026-10706 affects Adalo’s no-code app builder (V1 and V2). A platform‑level flaw in the database API allows authenticated users to retrieve full user records from any Adalo application, via dbId enumeration, bypassing ownership checks and enabling cross‑application data exposure. The issue i...