{"id":"CVE-2026-120446","kind":"vulnerability","aliases":["CVE-2026-120446"],"related":[],"title":"madong-admin-saas: missing authentication lets anyone manage tenant accounts","description":"madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.","summary":"madong-admin-saas through version 5.1.4 has a platform tenant management API that skips its authentication check because a middleware key never matches the application name. An unauthenticated remote attacker can list, create, modify, disable or delete tenants and bind subscription plans.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["madong-admin-saas","multi-tenant","package","self-hosted"],"not_affected_if":["platformapi-routes-not-exposed","version-above-5.1.4"],"how_to_check":"- Check the installed madong-admin-saas version; affected if it is `5.1.4` or earlier\n- Look for the `/platformapi/tenant/account`, `bind-plan` and `sync-data` routes on a running instance\n- Confirm whether those routes answer without a login token","fix":"- Move to a version later than `5.1.4`; the patched release is not named in the sources","status":"open","published_at":"2026-11-02T15:17:27+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","triaged_at":"2026-11-02T15:25:43+00:00","updated_at":"2026-11-02T15:25:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T15:25:43Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version later than `5.1.4`; the patched release is not named in the sources","reach":"internet","title":"madong-admin-saas: missing authentication lets anyone manage tenant accounts","impact":"high","summary":"madong-admin-saas through version 5.1.4 has a platform tenant management API that skips its authentication check because a middleware key never matches the application name. An unauthenticated remote attacker can list, create, modify, disable or delete tenants and bind subscription plans.","audience":"businesses","category":"package","nicknames":[],"who_cares":["madong-admin-saas","self-hosted","multi-tenant"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker takes over tenant accounts and subscription plans across the platform","analyst_note":"Confirm the patched version from the github.com fix link and whether default deployments expose the platformapi routes.","how_to_check":"- Check the installed madong-admin-saas version; affected if it is `5.1.4` or earlier\n- Look for the `/platformapi/tenant/account`, `bind-plan` and `sync-data` routes on a running instance\n- Confirm whether those routes answer without a login token","plain_action":"","needs_analyst":true,"not_affected_if":["version-above-5.1.4","platformapi-routes-not-exposed"],"who_is_affected":"Teams that run madong-admin-saas 5.1.4 or earlier as a multi-tenant SaaS platform with the platform tenant API reachable over the network. Deployments that do not expose the platformapi routes to untrusted networks are less exposed, but the sources do not say how reachable they must be.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000723,"input_tokens":4187,"output_tokens":609,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-120446':14A,17A '-2026':13A,16A '/platformapi/tenant/account':104C '5.1.4':35B,77C 'account':11A 'admin':3A,20B,31B,74C 'anyon':8A 'api':41B,88C 'applic':54B,98C 'attack':59B,101C 'authent':6A,45B,81C 'bind':69B,106C,122C 'bind-plan':105C 'call':103C 'check':46B 'contain':78C 'creat':62B,115C 'cve':12A,15A 'data':111C 'delet':66B,119C 'disabl':64B,117C 'endpoint':112C 'host':28B 'key':50B,93C 'let':7A 'list':61B,114C 'madong':2A,19B,30B,73C 'madong-admin-saa':1A,18B,29B,72C 'manag':9A,40B,87C 'match':52B,95C 'middlewar':49B,92C 'miss':5A,80C 'modifi':63B,116C 'multi':23B 'multi-ten':22B 'name':55B 'never':51B,94C 'packag':25B 'plan':71B,107C,124C 'platform':38B,85C,97C 'platformapi':91C 'remot':58B,100C 'saa':4A,21B,32B,75C 'self':27B 'self-host':26B 'skip':43B 'subscript':70B,123C 'sync':110C 'sync-data':109C 'tenant':10A,24B,39B,67B,86C,120C 'unauthent':57B,99C 'version':34B 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Teams that run madong-admin-saas 5.1.4 or earlier as a multi-tenant SaaS platform with the platform tenant API reachable over the network. Deployments that do not expose the platformapi routes to untrusted networks are less exposed, but the sources do not say how reachable they must be.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","madongadminsaas","multitenant","package","selfhosted"],"first_public_at":"2026-11-02T15:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120446","severity":null,"published_at":"2026-11-02T15:17:27+00:00","modified_at":"2026-11-02T15:17:27+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","fetched_at":"2026-11-02T15:24:02+00:00","note":null}],"documents":[{"id":52479,"url":"https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52482,"url":"https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-missing-authentication-via-platform-tenant-management-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}