CVE-2026-120446

Summary

The madong-admin-saas application (≤5.1.4) lacks proper authentication enforcement on critical tenant management endpoints due to a misconfigured middleware key ('platformapi' vs 'platform'), allowing unauthenticated remote attackers to perform full tenant lifecycle operations.

Exploitability

Trivial to exploit; no authentication or user interaction required, and the vulnerable endpoints are publicly accessible over the network.

Blast radius

Successful exploitation enables complete compromise of tenant data and subscription plans, potentially affecting all tenants in a multi-tenant SaaS environment, leading to data exfiltration, unauthorized plan modifications, or service disruption.

Detection

Look for unauthenticated HTTP requests (e.g., missing or invalid Authorization headers) to the /platformapi/tenant/* endpoints in web server or API gateway logs; repeated or bulk calls to these endpoints from a single source may indicate exploitation.

Prioritized remediation

Upgrade to madong-admin-saas version 5.1.5 or later, where the middleware key mismatch is corrected; until then, disable or restrict access to /platformapi/tenant/account, /platformapi/tenant/bind-plan, and /platformapi/tenant/sync-data endpoints at the reverse proxy or firewall level.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.