{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/madong-admin-saas--5.1.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:madong:madong-admin-saas:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.4,"id":"CVE-2026-120446"},{"cvss":8.8,"id":"CVE-2026-120445"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["madong-admin-saas (\u003c= 5.1.4)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","api-security","cve-2026-120446","privilege-escalation","access-control"],"_cs_type":"advisory","_cs_vendors":["madong"],"content_html":"\u003cp\u003eCVE-2026-120446 is a critical authentication bypass vulnerability in the 'madong-admin-saas' platform. The flaw originates from a middleware configuration error where the 'platformapi' key fails to validate against the 'platform' application, effectively disabling authentication for specific API endpoints. Unauthenticated attackers can access, modify, or delete tenant accounts and subscription plans by interacting directly with the exposed API.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to list, create, modify, disable, or delete tenants, and modify subscription plans via the platform tenant management API.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all instances of 'madong-admin-saas' running version 5.1.4 or earlier.\u003c/li\u003e\n\u003cli\u003ePrioritize upgrading to the latest patched version of the software.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, apply network access control lists (ACLs) to restrict access to the /platformapi/ endpoints to known-trusted management IP ranges.\u003c/li\u003e\n\u003cli\u003eImplement logging for all requests to the /platformapi/tenant/account, bind-plan, and sync-data endpoints to identify unauthorized access attempts.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-02T15:50:56Z","date_published":"2026-11-02T15:47:33Z","id":"https://feed.craftedsignal.io/briefs/2026-11-madong-admin-auth-bypass/","summary":"A missing authentication vulnerability in madong-admin-saas version 5.1.4 and earlier allows unauthenticated remote attackers to perform full CRUD operations on tenant management and subscription API endpoints.","title":"madong-admin-saas: Missing authentication in tenant management API (CVE-2026-120446)","url":"https://feed.craftedsignal.io/briefs/2026-11-madong-admin-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Madong-Admin-Saas (\u003c= 5.1.4)","version":"https://jsonfeed.org/version/1.1"}