CVE-2026-120446

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://cloud.projectdiscovery.io/library/CVE-2026-120446

Full discourse1 post

pdnuclei-bot@pdnuclei_bot19h
🚨 CVE-2026-120446 - high 🚨 madong-admin-saas <= 5.1.4 - Unauthenticated Platform Tenant Management Access > madong-admin-saas <= 5.1.4 contains a broken authentication caused by 'platformapi' m... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-120446 @pdnuclei #Nucle...
00000155
1.4K followersView on X

Explore more

Back to dashboard