HIGH 8.8 NVD
CVE-2026-120446
madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key n
madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.
References
- https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/app/platform/controller/tenan
- https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/config/middleware.php
- https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf25
- https://github.com/madong-code/madong-admin-saas/issues/2
- https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-missing-authenticatio
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-11-02 via NVD.
vulnfeed aggregates 17991 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.