CrowdSecLive Exploit Tracker
Insufficient DataCVE-2026-120446Public Exploit

madong-admin-saas - Authentication Bypass (CVE-2026-120446)

PublishedNov 2, 2026
First SeenNov 4, 2026
Last Seen
Reported
CVSS8.8
MC
Madong-codemadong-admin-saas
web_applicationmanagement_panel

Description

madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.

psychologyCrowdSec Analysis

CVE-2026-120446 is a high-severity authentication bypass in madong-admin-saas through version 5.1.4, caused by a middleware key mismatch in the platform tenant management API. Unauthenticated remote attackers can access tenant and subscription-plan endpoints to list, create, modify, disable, or delete tenants and bind plans.

CrowdSec has been tracking this vulnerability and its exploits since 4th of November 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-120446 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target /platformapi/tenant/account to access the tenant management API without authentication. This access may expose tenant data and enable unauthorized tenant or subscription-plan management.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2026-11-02
Rule Released2026-11-04

Related Weaknesses

CWE-306: Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References