{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10708", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-06-02T17:59:57.666Z", "datePublished": "2026-07-08T14:05:15.678Z", "dateUpdated": "2026-07-09T15:13:00.989Z"}, "containers": {"cna": {"title": "Insufficiently Protected Credentials", "descriptions": [{"lang": "en", "value": "This vulnerability enables large\u2011scale data harvesting without requiring app\u2011specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long\u2011lived twenty\u2011day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo application."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Adalo No-Code App Builder", "product": "App Builder", "versions": [{"status": "affected", "version": "1", "lessThanOrEqual": "2", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-522 Insufficiently Protected Credentials"}]}, {"descriptions": [{"lang": "en", "description": "CWE-346 Origin Validation Error"}]}, {"descriptions": [{"lang": "en", "description": "CWE-613 Insufficient Session Expiration"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/849433"}], "x_generator": {"engine": "VINCE 3.0.43", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-10708"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-08T14:05:15.678Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T15:12:56.923608Z", "id": "CVE-2026-10708", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T15:13:00.989Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-10708", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T15:12:56.923608Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T15:12:50.597Z"}}], "cna": {"title": "Insufficiently Protected Credentials", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Adalo No-Code App Builder", "product": "App Builder", "versions": [{"status": "affected", "version": "1", "versionType": "custom", "lessThanOrEqual": "2"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/849433"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.43", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-10708"}, "descriptions": [{"lang": "en", "value": "This vulnerability enables large\u2011scale data harvesting without requiring app\u2011specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long\u2011lived twenty\u2011day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo application."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-522 Insufficiently Protected Credentials"}]}, {"descriptions": [{"lang": "en", "description": "CWE-346 Origin Validation Error"}]}, {"descriptions": [{"lang": "en", "description": "CWE-613 Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-08T14:05:15.678Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10708", "state": "PUBLISHED", "dateUpdated": "2026-07-09T15:13:00.989Z", "dateReserved": "2026-06-02T17:59:57.666Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-07-08T14:05:15.678Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1,2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "App Builder", "source": "cna", "vendor": "Adalo No-Code App Builder"}, "product": "app_builder", "vendor": "adalo_no-code_app_builder"}], "created": "2026-07-09T10:00:15.453316+00:00", "updated": "2026-07-10T20:45:04.291742+00:00", "vendors": ["adalo_no-code_app_builder", "adalo_no-code_app_builder$PRODUCT$app_builder"]}