CVE-2026-120446

CriticalCVSS 9.4

Published: 02/11/2026(UTC)Translated: 02/11/2026(UTC)NVD NIST

Summary

madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints.

Risk Assessment

Unauthenticated attackers can list, create, modify, disable or delete tenants and bind subscription plans, severely breaking tenant isolation and access control.

Recommendation

Update madong-admin-saas beyond 5.1.4 and verify that the 'platformapi' middleware correctly maps to the 'platform' application.

Other vulnerabilities in madong-admin-saas

CVE-2026-120445High
madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS