The vulnerability is a missing authentication flaw that allows unauthenticated remote attackers to invoke the platform tenant management API. By calling the /platformapi/tenant/account, bind‑plan, and sync‑data endpoints, an attacker can list, create, modify, disable, or delete tenant accounts and bind subscription plans. This results in loss of integrity, availability, and confidentiality for all tenants managed by the application, effectively providing an attacker with full administrative control over tenant configurations.

The affected product is madong-admin-saas version 5.1.4 from the vendor madong-code. No other versions are listed as impacted in the available data.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attacker requires network access to the tenant management API; no privileged credentials are needed. Once accessed, the attacker can perform arbitrary tenant management actions, making this a critical risk for environments running the vulnerable version.