madong-admin-saas <= 5.1.4 - Unauthenticated Platform Tenant Management Access
CVE-2026-120446
Early Release
Description
madong-admin-saas <= 5.1.4 contains a broken authentication caused by 'platformapi' middleware key mismatch in platform tenant management API, letting unauthenticated remote attackers manage tenants and subscription plans.
Severity
High
CVSS Score
8.8
Affected Product
madong-admin-saas
Published Date
November 4, 2026
Template Author
maulanawirawan
CVE-2026-120446.yaml
8.8Score
CVSS Metrics
CVSS Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
CVE ID:
cve-2026-120446
CWE ID:
cwe-306
References
https://github.com/madong-code/madong-admin-saas/issues/2https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-missing-authentication-via-platform-tenant-management-apihttps://nvd.nist.gov/vuln/detail/CVE-2026-120446
Remediation Steps
Update to the latest version beyond 5.1.4.