Adalo No-Code Application Platform Database API Cross-App User Data Exposure Vulnerability

A vulnerability in the Adalo database API allows authenticated users to access complete user records from any Adalo application, bypassing application-specific authorization controls. This issue arises from the API's failure to enforce ownership-aware, server-side authorization checks, combined with a permissive CORS policy and the exposure of long-lived JWT tokens. As a result, attackers can automate the extraction of sensitive personal information, including emails and custom fields, from over one million Adalo applications.

Impact

Exploitation of this vulnerability leads to unauthorized access and extraction of full user records, including sensitive personal information, from any Adalo application.

Remediation

Adalo has acknowledged this access control weakness but has not yet released a patch. In the meantime, users should avoid storing sensitive information in Adalo collections and remain vigilant for phishing and identity theft risks.