AI analysis
Claude Opus · 9 Nov 2026, 10:19 CET
madong-admin-saas tenant management API reachable without authentication
madong-admin-saas through 5.1.4 exposes its platform tenant management API without authentication. Remote attackers can list, create, modify, disable or delete tenants. Restrict access to /platformapi/ routes now and review the referenced upstream commit.
In plain terms
madong-admin-saas is a multi-tenant administration platform. A multi-tenant system serves many separate customers, or tenants, from one installation. In versions up to and including 5.1.4, the part of the application that manages those tenants at the platform level does not check who is making a request. Authentication, the step that confirms a user is who they claim to be, is effectively skipped for these functions.
Anyone who can reach the application over the network could therefore view the list of tenants, create new ones, change or disable existing ones, delete them, or attach subscription plans to them. Operators running madong-admin-saas as a hosted service for customers should treat this as urgent, because one outside party could disrupt or take over the tenant structure of the whole platform.