madong-admin-saas Tenant Management API Missing Authentication Vulnerability

madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application.

Unauthenticated remote attackers can call these endpoints:

• /platformapi/tenant/account
• bind-plan
• sync-data

This allows listing, creating, modifying, disabling or deleting tenants and binding subscription plans.