VU#849433: Adalo Database API Enables Cross-App User Data Extraction via Over-Fetching and Missing Authorization Controls
2026-07-08T20:52:13Z•2e88f97626e5534519fabd99df0c22ab713e083e4cdb36a4ebd94c1c5eb731d0
adaloauthentication-backdoorauthorization-bypasscors-misconfigurationdata-exposuredesktop-softwarefaststonefirmware-backdoorgfafheap-buffer-overflowhpimage-parsingjwt-token-reusekernel-driverlittle-orbitlocal-privilege-escalationmissing-authorizationno-code-platformprintersremote-code-executionrouterssecure-boot-bypasstendauefiwinre
What happened
This feed aggregates multiple high-impact vulnerabilities across cloud platforms, consumer devices, desktop software, and firmware. Notable issues include a platform-level authorization flaw in Adalo’s Database API allowing authenticated users to retrieve full user records across >1M apps (CVE-2026-10706) and exposed long‑lived JWT tokens enabling mass data extraction (CVE-2026-10708); an undocumented administrative backdoor in multiple Tenda firmwares (CVE-2026-11405); missing authorization in HP Deskjet 2800 series web APIs exposing Wi‑Fi and management credentials (CVE-2026-13753); multiple
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 2e88f97626e5534519fabd99df0c22ab713e083e4cdb36a4ebd94c1c5eb731d0
- Enrichment time
- 2026-07-08T20:52:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.