Live › vulnerability › CVE-2026-120446
madong-admin-saas through version 5.1.4 has a platform tenant management API that skips its authentication check because a middleware key never matches the application name. An unauthenticated remote attacker can list, create, modify, disable or delete tenants and bind subscription plans.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Teams that run madong-admin-saas 5.1.4 or earlier as a multi-tenant SaaS platform with the platform tenant API reachable over the network. Deployments that do not expose the platformapi routes to untrusted networks are less exposed, but the sources do not say how reachable they must be.
No product ranges from the sources yet.
5.1.4 or earlier/platformapi/tenant/account, bind-plan and sync-data routes on a running instance5.1.4; the patched release is not named in the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.
This page as .md · .json · in your agent: get_signal("CVE-2026-120446")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.