madong-admin-saas platform tenant management API lacks authentication

Anyone online can delete or change customer accounts in this web admin program!

Summary

The platform tenant management API in madong-admin-saas through 5.1.4 lacks authentication. Unauthenticated remote attackers can list, create, modify, disable or delete tenants and bind subscription plans.

What to do

Versions through 5.1.4 are affected. No source names a fixed version, so check that the product runs a version newer than 5.1.4 and read the vendor's advisory.

Products and platforms

madong-admin-saas

CVE IDs

CVE-2026-120446 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-02 14:29 UTC

First seen 2026-11-09 14:10 UTC