Unauthenticated Tenant Takeover in madong-admin-saas Platform API (CVE-2026-120446)

CVE-2026-120446 is a critical missing-authentication flaw in madong-admin-saas through version 5.1.4. Remote attackers with no credentials can call the platform tenant management API to list, create, modify, disable or delete tenants.

What Is It

The flaw is in the platform tenant management API of madong-admin-saas, an open-source project from madong-code. The authentication middleware is registered under the key platformapi, but that key never matches the platform application. As a result, the tenant management endpoints run with no authentication at all.

VulnCheck disclosed the issue and classifies it as CWE-306 (Missing Authentication for Critical Function). NVD published the record on 2026-11-02 and lists its status as "Deferred."

Why It Matters

According to the advisory, unauthenticated remote attackers can call these endpoints:

• /platformapi/tenant/account
• bind-plan
• sync-data

Through these endpoints, an attacker can list, create, modify, disable or delete tenants, and can bind subscription plans. In a multi-tenant SaaS deployment, this gives an outsider control over the platform's tenant layer.

VulnCheck's scores:

• CVSS 3.1: 9.4 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H). The attack works over the network, has low complexity, and needs no privileges or user interaction. Integrity and availability impact are high, and confidentiality impact is low.
• CVSS 4.0: 8.8 HIGH.

The CISA Known Exploited Vulnerabilities (KEV) Catalog has no entry for this CVE, so KEV does not currently confirm active exploitation. The CVSS 4.0 exploit maturity field is "Not Defined."

What's Vulnerable

• Vendor: madong-code
• Product: madong-admin-saas
• Affected versions: all versions up to and including 5.1.4
• Repository: https://github.com/madong-code/madong-admin-saas

NVD lists no CPE entries for this product.

Patch Status

The NVD record does not name a fixed version. It does reference a commit in the project repository (2a199a1) and a GitHub issue (#2). Administrators should review both to check whether the commit fixes the middleware mismatch.

Until a fixed release is confirmed, treat every deployment running 5.1.4 or earlier as exposed. Make sure the /platformapi/ tenant endpoints cannot be reached from untrusted networks. Because the CVE is not in the CISA KEV Catalog, neither CISA nor NVD has issued a required action.

Sources

• NVD, CVE-2026-120446
• VulnCheck Advisory; madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API
• CISA, Known Exploited Vulnerabilities Catalog
• GitHub; madong-admin-saas Issue #2
• GitHub; madong-admin-saas Commit 2a199a1
• GitHub; config/middleware.php (v5.1.4)
• GitHub; AccountController.php (v5.1.4)