Madong Admin SaaS CVE-2026-120446

No special conditions - remote unauthenticated exploitation against default configurations of madong-admin-saas through 5.1.4, because the shipped config/middleware.php registered the authentication middleware under the key 'platformapi' instead of the webman application name 'platform', so AccessTokenMiddleware was never applied to the platform tenant-management endpoints. The affected endpoints are /platformapi/tenant/account, /platformapi/tenant/bind-plan and /platformapi/tenant/sync-data. Limiting factors: the attacker must have network reachability to the platform API surface (an internet-exposed or otherwise accessible instance), and the deployed version must be at or below 5.1.4; applying the vendor fix removes access entirely for non-platform/root identities.

All exploitability signals point to an easy-to-trigger flaw: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated call with no user interaction, and the source diff confirms the mechanism - the middleware config used the key 'platformapi' (a route prefix) instead of the webman application name 'platform', so the platform application's AccessTokenMiddleware was never loaded and the tenant-management endpoints ran with no authentication at all. The high 8.8 score and the CWE-306 missing-authentication classification are therefore well supported by concrete evidence. However, the decision signals temper urgency: the vuln.today priority label is 'this_week', NOT act_now or emergency; no KEV listing is present (not confirmed actively exploited); no EPSS score was supplied, so exploitation probability cannot be quantified; and no verified working exploit code is referenced. The dominant mitigating factor is real-world footprint - madong-admin-saas is an obscure open-source project, so despite the severe, trivially exploitable defect, mass opportunistic exploitation is unlikely and this reads as a genuine but narrowly-scoped priority rather than an internet-wide emergency. Net: fix within the week as the vendor priority suggests, prioritized by whether any instance is actually internet-exposed.

An unauthenticated attacker who can reach the application sends a request to /platformapi/tenant/account (or bind-plan / sync-data); because the platform application never loaded its AccessTokenMiddleware, the request is processed with no identity check, letting the attacker enumerate, create, modify, disable or delete tenants and bind subscription plans. No public exploit is identified at time of analysis, but the vulnerable endpoints and root cause are documented in the VulnCheck advisory and the vendor patch commit. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a single low-complexity remote request with no prerequisites.