---
id: "CVE-2026-120446"
kind: "vulnerability"
aliases: ["CVE-2026-120446"]
title: "madong-admin-saas: missing authentication lets anyone manage tenant accounts"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["madong-admin-saas", "multi-tenant", "package", "self-hosted"]
not_affected_if: ["platformapi-routes-not-exposed", "version-above-5.1.4"]
published_at: "2026-11-02T15:17:27+00:00"
first_seen_at: "2026-11-02T15:24:02+00:00"
updated_at: "2026-11-02T15:25:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120446", "first_seen_at": "2026-11-02T15:24:02+00:00"}]
---

# madong-admin-saas: missing authentication lets anyone manage tenant accounts

madong-admin-saas through version 5.1.4 has a platform tenant management API that skips its authentication check because a middleware key never matches the application name. An unauthenticated remote attacker can list, create, modify, disable or delete tenants and bind subscription plans.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed madong-admin-saas version; affected if it is `5.1.4` or earlier
- Look for the `/platformapi/tenant/account`, `bind-plan` and `sync-data` routes on a running instance
- Confirm whether those routes answer without a login token

## Fix

- Move to a version later than `5.1.4`; the patched release is not named in the sources

## Timeline

- 2026-11-02T15:24:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120446

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-missing-authentication-via-platform-tenant-management-api
- [fix] Patch: github.com https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39

## From the sources

madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_