{"id":"CVE-2026-120446","published":"2026-11-02T15:17:27.323","lastModified":"2026-11-02T19:35:33.347","description":"madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.","cvssScore":9.4,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/app/platform/controller/tenant/AccountController.php#L26","tags":[]},{"url":"https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/config/middleware.php","tags":[]},{"url":"https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39","tags":[]},{"url":"https://github.com/madong-code/madong-admin-saas/issues/2","tags":[]},{"url":"https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-missing-authentication-via-platform-tenant-management-api","tags":[]}],"exploitRefs":[{"url":"https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/app/platform/controller/tenant/AccountController.php#L26","tags":[]},{"url":"https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/config/middleware.php","tags":[]},{"url":"https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39","tags":[]},{"url":"https://github.com/madong-code/madong-admin-saas/issues/2","tags":[]}],"hasPoc":true,"ai":{"summary":"The madong-admin-saas application (≤5.1.4) lacks proper authentication enforcement on critical tenant management endpoints due to a misconfigured middleware key ('platformapi' vs 'platform'), allowing unauthenticated remote attackers to perform full tenant lifecycle operations.","exploitability":"Trivial to exploit; no authentication or user interaction required, and the vulnerable endpoints are publicly accessible over the network.","blast_radius":"Successful exploitation enables complete compromise of tenant data and subscription plans, potentially affecting all tenants in a multi-tenant SaaS environment, leading to data exfiltration, unauthorized plan modifications, or service disruption.","remediation":"Upgrade to madong-admin-saas version 5.1.5 or later, where the middleware key mismatch is corrected; until then, disable or restrict access to /platformapi/tenant/account, /platformapi/tenant/bind-plan, and /platformapi/tenant/sync-data endpoints at the reverse proxy or firewall level.","detection":"Look for unauthenticated HTTP requests (e.g., missing or invalid Authorization headers) to the /platformapi/tenant/* endpoints in web server or API gateway logs; repeated or bulk calls to these endpoints from a single source may indicate exploitation.","tags":["auth-bypass","multi-tenant","saaas","tenant-abuse"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:55:42.628Z"}}