CVE-2026-120446: madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API

Published Nov 2, 2026

Updated

madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments of madong-admin-saas through version 5.1.4 are affected where the platform tenant management API is reachable. The affected endpoints are under /platformapi/tenant/, including account, bind-plan, and sync-data.

Does exploitation require credentials or user interaction?

No. The vulnerability allows unauthenticated remote attackers to access the affected API endpoints, with no privileges or user interaction required.

What could an attacker do through the exposed API?

An attacker can list, create, modify, disable, or delete tenants, and can bind subscription plans. This can affect tenant integrity and availability.

How can I check whether an instance is affected?

Review the middleware configuration for the platform application: the issue occurs because the platformapi middleware key does not match the platform application. Also determine whether unauthenticated requests can reach /platformapi/tenant/account, /bind-plan, or /sync-data.

What is the underlying configuration issue to remediate?

Correct the middleware configuration so that authentication is applied to the platform tenant management API. The referenced upstream commit 2a199a1523ed749c94b876bc2ae5fedf252b2e39 addresses the issue.

CVE-2026-120446: madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require credentials or user interaction?

What could an attacker do through the exposed API?

How can I check whether an instance is affected?

What is the underlying configuration issue to remediate?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require credentials or user interaction?

What could an attacker do through the exposed API?

How can I check whether an instance is affected?

What is the underlying configuration issue to remediate?