Live › vulnerability › CVE-2026-120445
madong-admin-saas through 5.1.4 has an authorization flaw: in multi-tenant mode the platform AccessTokenMiddleware did not reject tenant tokens, so a logged-in tenant user can call the platform management API with their tenant JWT. VulnCheck says this allows creating platform admin accounts, reading tenant database settings and taking over every tenant. Upstream fixed it in a commit on 2 Nov 2026; no fixed release version is named.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Deployments of madong-admin-saas through 5.1.4 running in multi-tenant mode, where tenant users hold valid login tokens. Single-tenant installs and deployments that do not expose the platform API to tenant tokens are not described as affected by the sources. unknown for the exact exposure beyond that.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| madong-admin-saas | other | <= 5.1.4 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.
This page as .md · .json · in your agent: get_signal("CVE-2026-120445")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.