CVE-2026-10708

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10708", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-06-02T17:59:57.666Z", "datePublished": "2026-07-08T14:05:15.678Z", "dateUpdated": "2026-07-09T15:13:00.989Z"}, "containers": {"cna": {"title": "Insufficiently Protected Credentials", "descriptions": [{"lang": "en", "value": "This vulnerability enables large\u2011scale data harvesting without requiring app\u2011specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long\u2011lived twenty\u2011day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo application."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Adalo No-Code App Builder", "product": "App Builder", "versions": [{"status": "affected", "version": "1", "lessThanOrEqual": "2", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-522 Insufficiently Protected Credentials"}]}, {"descriptions": [{"lang": "en", "description": "CWE-346 Origin Validation Error"}]}, {"descriptions": [{"lang": "en", "description": "CWE-613 Insufficient Session Expiration"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/849433"}], "x_generator": {"engine": "VINCE 3.0.43", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-10708"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-08T14:05:15.678Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T15:12:56.923608Z", "id": "CVE-2026-10708", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T15:13:00.989Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-10708", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T15:12:56.923608Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T15:12:50.597Z"}}], "cna": {"title": "Insufficiently Protected Credentials", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Adalo No-Code App Builder", "product": "App Builder", "versions": [{"status": "affected", "version": "1", "versionType": "custom", "lessThanOrEqual": "2"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/849433"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.43", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-10708"}, "descriptions": [{"lang": "en", "value": "This vulnerability enables large\u2011scale data harvesting without requiring app\u2011specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long\u2011lived twenty\u2011day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo application."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-522 Insufficiently Protected Credentials"}]}, {"descriptions": [{"lang": "en", "description": "CWE-346 Origin Validation Error"}]}, {"descriptions": [{"lang": "en", "description": "CWE-613 Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-08T14:05:15.678Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10708", "state": "PUBLISHED", "dateUpdated": "2026-07-09T15:13:00.989Z", "dateReserved": "2026-06-02T17:59:57.666Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-07-08T14:05:15.678Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "App Builder", "vendor": "Adalo No-Code App Builder", "versions": [{"lessThanOrEqual": "2", "status": "affected", "version": "1", "versionType": "custom"}]}], "source": "cret@cert.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This vulnerability enables large\u2011scale data harvesting without requiring app\u2011specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long\u2011lived twenty\u2011day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo application."}, {"lang": "es", "value": "Esta vulnerabilidad permite la recolecci\u00f3n de datos a gran escala sin requerir secretos espec\u00edficos de la aplicaci\u00f3n. Una \u00fanica solicitud a un componente m\u00ednimo de tabla de clasificaci\u00f3n puede devolver registros de usuario que contienen correos electr\u00f3nicos, UUIDs y campos personalizados. La combinaci\u00f3n del comportamiento CORS con comod\u00edn, los JWTs de veinte d\u00edas de larga duraci\u00f3n y la ausencia de revocaci\u00f3n de tokens permite a los atacantes recopilar informaci\u00f3n personal sensible de cualquier aplicaci\u00f3n de Adalo."}], "id": "CVE-2026-10708", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10708", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T15:12:56.923608Z", "version": "2.0.3"}}]}, "published": "2026-07-08T15:16:25.377", "references": [{"source": "cret@cert.org", "url": "https://kb.cert.org/vuls/id/849433"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Deferred"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1,2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "App Builder", "source": "cna", "vendor": "Adalo No-Code App Builder"}, "product": "app_builder", "vendor": "adalo_no-code_app_builder"}], "created": "2026-07-09T10:00:15.453316+00:00", "updated": "2026-08-03T05:00:15.997371+00:00", "vendors": ["adalo_no-code_app_builder", "adalo_no-code_app_builder$PRODUCT$app_builder"], "weaknesses": ["CWE-284", "CWE-285", "CWE-613"]}