CVE-2026-120446 Details

A missing authentication vulnerability has been identified in Madong Admin SaaS versions through 5.1.4. The issue resides within the platform tenant management API, specifically because the 'platformapi' middleware key does not align with the 'platform' application. This flaw allows unauthenticated remote attackers to access the '/platformapi/tenant/account' endpoint, as well as the 'bind-plan' and 'sync-data' endpoints. Exploiting this vulnerability enables attackers to list, create, modify, disable, or delete tenant accounts and manage subscription plans.

The vulnerability has been addressed in version 5.1.4. Users should update to this version. For those unable to update, it is recommended to manually implement the authentication checks by restoring the 'platform' middleware and ensuring it is applied to the 'platformapi' group.