Adalo Database API Enables Cross-App User Data Extraction via Over-Fetching and Missing Authorization Controls

Overview Adalo’s no‑code application platform exposes complete user records through its database API for all applications built on both V1 and V2. Due to a platform-level flaw, authenticated users can retrieve full user data belonging to any Adalo application, regardless of configuration. This...

Adoption Agency Data Exposure Revealed Information About Children and Parents

A trove of 1.1 million records left accessible on the open web shows how much sensitive information can be created—and made vulnerable—during the adoption process...