CVE-2026-120446 Scanner
CVE-2026-120446 Scanner - Unauthorized Admin Access vulnerability in madong-admin-saas
Used 3 times · 3.4k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-120446
8.8
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
madong-admin-saas
Updated Nov 6, 2026View on NVD →
S4E scanner
CVE history: madong-admin-saas
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →