Cve-2026-120446 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-120446/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 15:47:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgmadong-admin-saas: Missing authentication in tenant management API (CVE-2026-120446)https://feed.craftedsignal.io/briefs/2026-11-madong-admin-auth-bypass/Mon, 02 Nov 2026 15:47:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-madong-admin-auth-bypass/A missing authentication vulnerability in madong-admin-saas version 5.1.4 and earlier allows unauthenticated remote attackers to perform full CRUD operations on tenant management and subscription API endpoints.CVE-2026-120446 is a critical authentication bypass vulnerability in the 'madong-admin-saas' platform. The flaw originates from a middleware configuration error where the 'platformapi' key fails to validate against the 'platform' application, effectively disabling authentication for specific API endpoints. Unauthenticated attackers can access, modify, or delete tenant accounts and subscription plans by interacting directly with the exposed API.

Impact

Successful exploitation allows unauthenticated remote attackers to list, create, modify, disable, or delete tenants, and modify subscription plans via the platform tenant management API.

Recommendation

  1. Inventory all instances of 'madong-admin-saas' running version 5.1.4 or earlier.
  2. Prioritize upgrading to the latest patched version of the software.
  3. If immediate patching is not possible, apply network access control lists (ACLs) to restrict access to the /platformapi/ endpoints to known-trusted management IP ranges.
  4. Implement logging for all requests to the /platformapi/tenant/account, bind-plan, and sync-data endpoints to identify unauthorized access attempts.
]]>criticaladvisoryauthentication-bypassapi-securitycve-2026-120446privilege-escalationaccess-control