CVE-2026-120446
Received Received - Intake

Missing Authentication in Madong Admin SaaS Platform

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120446

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
madong-code madong-admin-saas 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120446 is a missing authentication vulnerability in madong-admin-saas through version 5.1.4. The 'platformapi' middleware key does not match the 'platform' application, allowing unauthenticated remote attackers to access sensitive endpoints like /platformapi/tenant/account, bind-plan, and sync-data. This enables attackers to list, create, modify, disable, or delete tenants and bind subscription plans without authentication.

Detection Guidance

Check for unauthorized access to the endpoints /platformapi/tenant/account, /platformapi/tenant/bind-plan, and /platformapi/tenant/sync-data. Monitor logs for requests to these paths without valid authentication tokens. Use network traffic analysis tools like Wireshark or tcpdump to inspect HTTP requests targeting these endpoints.

Impact Analysis

This vulnerability allows attackers to fully control tenant management in the affected SaaS application. They can create malicious tenants, modify existing ones, disable services, delete data, or bind unauthorized subscription plans. This could lead to data breaches, service disruption, financial losses, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires strict access controls for personal data, while HIPAA mandates protection of health information. The lack of authentication could result in unauthorized data exposure, leading to regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade madong-admin-saas to a version that fixes the missing authentication issue. If an upgrade is not immediately possible, restrict access to the vulnerable endpoints via firewall rules or web application firewall (WAF) configurations. Ensure all API requests include proper authentication and authorization checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120446. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...