CVE-2026-120445: madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware

Published Nov 2, 2026

Updated

madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated tenant user in a multi-tenant deployment can exploit it. The attacker needs a valid tenant login JWT and does not need an existing platform administrator account.

What access can an attacker gain?

An attacker can reuse a tenant JWT against /platformapi controllers to create platform administrator accounts and read tenant database settings. This can enable control over every tenant.

How can I determine whether my deployment is affected?

Deployments of madong-admin-saas through version 5.1.4 are affected when operating in multi-tenant mode. Review whether a tenant-issued JWT is accepted by /platformapi endpoints by the AccessTokenMiddleware.

What should be done if patching cannot happen immediately?

Restrict access to /platformapi endpoints so tenant users and untrusted network clients cannot reach them, and monitor for tenant JWTs being used against those controllers. Review platform administrator accounts for unexpected creations and investigate access to tenant database settings.

CVE-2026-120445: madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware

Event History

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain?

How can I determine whether my deployment is affected?

What should be done if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain?

How can I determine whether my deployment is affected?

What should be done if patching cannot happen immediately?