Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-120446: madong-admin-saas lets anyone modify tenant accounts

CVE-2026-120446 · published today

Summary

The madong-admin-saas service (versions up to 5.1.4) does not check who is calling its tenant‑management functions. As a result, anyone on the internet can list, create, change, disable or delete tenant accounts and their subscription plans. Apply the vendor’s update or restrict access to the affected URLs until a patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
madong-code	madong-admin-saas	<= 5.1.4

Original advisory text

madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API

madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.

References

https://github.com/madong-code/madong-admin-saas/issues/2 Third Party Advisory
https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc... Patch
https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/app/platform/contro... Third Party Advisory
https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/config/middleware.p... Third Party Advisory
https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-missing-aut... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-1204... Vendor Advisory
https://github.com/madong-code/madong-admin-saas Product
https://nvd.nist.gov/vuln/detail/CVE-2026-120446 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

9.4 Critical

Type

CWE-306Missing Authentication for Critical Function

Timeline

Published2 Nov 2026

Updated3 Nov 2026

First seen2 Nov 2026

Sources

CVE-2026-120446 · NVD

CVE-2026-120446 · MITRE

CVE-2026-120446 · OSV

Track software like this

Free during beta