Skip to content
Threat Feed
Subscribe
critical advisory

madong-admin-saas: Missing authentication in tenant management API (CVE-2026-120446)

A missing authentication vulnerability in madong-admin-saas version 5.1.4 and earlier allows unauthenticated remote attackers to perform full CRUD operations on tenant management and subscription API endpoints.

CVE search metadata

CVE search record: CVE-2026-120446. Severity: critical. CVSS: 9.4. KEV: no. Product: madong-admin-saas (<= 5.1.4). Brief: madong-admin-saas: Missing authentication in tenant management API (CVE-2026-120446). Brief link: https://feed.craftedsignal.io/briefs/2026-11-madong-admin-auth-bypass/

CVE search record: CVE-2026-120445. Severity: high. CVSS: 8.8. KEV: no. Product: madong-admin-saas (<= 5.1.4). Brief: madong-admin-saas: Missing authentication in tenant management API (CVE-2026-120446). Brief link: https://feed.craftedsignal.io/briefs/2026-11-madong-admin-auth-bypass/

Triage facts

Revision 2
Applicability
madong-admin-saas (<= 5.1.4)
Evidence
Unknown
Severity
Critical
Action
Elevated
Sources
2 public sources
Freshness
Revision 2Nov 2, 15:52 UTC
Detection
1 rule
Vulnerabilities
2 CVEs
Source quality
A2Roughly even chance
Revision history 1 entry · Revision 2
  1. Revision 2

    added coverage for madong-admin-saas (<= 5.1.4)

    Changed: action_plan, cves, lastmod, priority_signals, qa_status, references, tags, ttps, updates

    Sources: 1

CVE-2026-120446 is a critical authentication bypass vulnerability in the 'madong-admin-saas' platform. The flaw originates from a middleware configuration error where the 'platformapi' key fails to validate against the 'platform' application, effectively disabling authentication for specific API endpoints. Unauthenticated attackers can access, modify, or delete tenant accounts and subscription plans by interacting directly with the exposed API.

Impact

Successful exploitation allows unauthenticated remote attackers to list, create, modify, disable, or delete tenants, and modify subscription plans via the platform tenant management API.

Recommendation

  1. Inventory all instances of 'madong-admin-saas' running version 5.1.4 or earlier.
  2. Prioritize upgrading to the latest patched version of the software.
  3. If immediate patching is not possible, apply network access control lists (ACLs) to restrict access to the /platformapi/ endpoints to known-trusted management IP ranges.
  4. Implement logging for all requests to the /platformapi/tenant/account, bind-plan, and sync-data endpoints to identify unauthorized access attempts.

Immediate actions

Inventory madong-admin-saas deployments and identify versions <= 5.1.4

IT Operations 24h

Patch madong-admin-saas once the vendor releases a version > 5.1.4

IT Operations As Available

Threat Hunt

Search for unauthorized POST/PUT/DELETE methods against /platformapi/tenant/ endpoints

T1190 high high confidence hunt now

Data: webserver access logs

Identify unauthorized access attempts to the /platformapi/ path originating from tenant-assigned JWTs

T1068 high high confidence hunt now

Data: Web server access logs or application-level audit logs

Mitigations

Restrict network access to /platformapi/ endpoints to trusted management infrastructure

immediate IT Operations

CVE-2026-120446

Detection coverage 1

Detect CVE-2026-120446 Exploitation - Unauthorized Access to Tenant API

critical

Detects unauthenticated access attempts to restricted tenant management endpoints in madong-admin-saas

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →