Missing Authentication in madong-admin-saas Platform Tenant Management API

CVE-2026-120446

What is CVE-2026-120446?

The madong-admin-saas application version 5.1.4 exhibits a missing authentication vulnerability within its platform tenant management API. Due to a misconfiguration, the 'platformapi' middleware key fails to validate against the 'platform' application, enabling unauthorized remote attackers to exploit several endpoints. Attackers can issue requests to /platformapi/tenant/account, bind-plan, and sync-data without proper authentication, potentially leading to unauthorized operations such as listing, creating, modifying, disabling, or deleting tenant accounts and binding subscription plans.

References