{"id":"CVE-2026-120445","kind":"vulnerability","aliases":["CVE-2026-120445"],"related":[],"title":"madong-admin-saas: tenant login token reaches platform admin API","description":"madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.","summary":"madong-admin-saas through 5.1.4 has an authorization flaw: in multi-tenant mode the platform AccessTokenMiddleware did not reject tenant tokens, so a logged-in tenant user can call the platform management API with their tenant JWT. VulnCheck says this allows creating platform admin accounts, reading tenant database settings and taking over every tenant. Upstream fixed it in a commit on 2 Nov 2026; no fixed release version is named.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"madong-admin-saas","fixed":[],"affected":"<= 5.1.4","ecosystem":"other"}],"ecosystems":[],"tags":["madong-admin-saas","multi-tenant","other","php","saas","webman"],"not_affected_if":["single-tenant"],"how_to_check":"- Versions up to and including 5.1.4 are listed as affected; only multi-tenant mode (tenant.enable = true) is described as exposed.\n- In app/platform/middleware/AccessTokenMiddleware.php, vulnerable code only rejects non-platform tokens when config('tenant.enable') !== true. The fix checks for the platform or root admin type unconditionally.\n- In config/middleware.php, the platform middleware group is keyed 'platformapi' (vulnerable; it does not take effect). The fix keys it 'platform' and attaches AccessTokenMiddleware to the group.\n- How to read the installed version: unknown, the sources do not say.","fix":"Upstream fixed it in commit 2a199a1523ed749c94b876bc2ae5fedf252b2e39 (2 Nov 2026); no release version containing it is named in the sources. Until a release is tagged, update to a build that includes that commit, or apply the patch to app/platform/middleware/AccessTokenMiddleware.php and config/middleware.php.","status":"open","published_at":"2026-11-02T15:17:27+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","triaged_at":"2026-11-02T15:25:48+00:00","updated_at":"2026-11-02T15:27:47+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-02T15:25:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"madong-admin-saas: tenant login token reaches platform admin API","impact":"high","summary":"madong-admin-saas through 5.1.4 has an authorization flaw in AccessTokenMiddleware that lets a logged-in tenant user call the platform management API in multi-tenant mode. An attacker can reuse a tenant JWT to create platform administrator accounts, read tenant database settings, and take over every tenant.","audience":"businesses","category":"other","nicknames":[],"who_cares":["madong-admin-saas","multi-tenant","saas"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker becomes platform admin and reads all tenant database settings","analyst_note":"Confirm the fixed version and the patch commit at the GitHub link and the VulnCheck advisory; sources give no fixed version.","how_to_check":"- Check whether the deployment runs madong-admin-saas in multi-tenant mode and which version is installed, `unknown` if the sources do not say how to read the version\n- Look for the `/platformapi` controllers in the deployed code and whether AccessTokenMiddleware checks the tenant on those routes\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["single-tenant"],"who_is_affected":"Deployments of madong-admin-saas through 5.1.4 running in multi-tenant mode, where tenant users hold valid login tokens. Single-tenant installs and deployments that do not expose the platform API to tenant tokens are not described as affected by the sources. unknown for the exact exposure beyond that.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4190,"output_tokens":606,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the patch commit at the GitHub link and the VulnCheck advisory; sources give no fixed version.","search":"'-120445':14A,17A '-2026':13A,16A '/platformapi':143C '2':97B '2026':99B '5.1.4':38B,111C 'access':125C 'accesstokenmiddlewar':50B,118C 'account':80B,149C 'admin':3A,10A,20A,24B,35B,79B,108C 'administr':148C 'allow':76B,120C 'api':11A,68B,129C 'attack':135C 'authent':121C 'author':41B,115C 'call':64B 'commit':95B 'contain':112C 'control':144C,156C 'creat':77B,146C 'cve':12A,15A 'databas':83B,152C 'everi':88B,158C 'fix':91B,101B 'flaw':42B 'incorrect':114C 'jwt':72B,141C 'log':59B 'logged-in':58B 'login':6A,140C 'madong':2A,19A,23B,34B,107C 'madong-admin-saa':1A,22B,33B,106C 'madong-admin-saas':18A 'manag':67B,128C 'mode':47B,134C 'multi':27B,45B,132C 'multi-ten':26B,44B,131C 'name':105B 'nov':98B 'php':30B 'platform':9A,49B,66B,78B,127C,147C 'reach':8A 'read':81B,150C 'reject':53B 'releas':102B 'reus':137C 'saa':4A,25B,31B,36B,109C 'saas':21A 'say':74B 'set':84B,153C 'take':86B,155C 'tenant':5A,28B,46B,54B,61B,71B,82B,89B,122C,133C,139C,151C,159C 'token':7A,55B 'upstream':90B 'user':62B,123C 'version':103B 'vulncheck':73B 'vulner':116C 'webman':32B","nicknames":[],"mitigations":[],"who_affected":"Deployments of madong-admin-saas through 5.1.4 running in multi-tenant mode, where tenant users hold valid login tokens. Single-tenant installs and deployments that do not expose the platform API to tenant tokens are not described as affected by the sources. unknown for the exact exposure beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["madongadminsaas"],"ptokens":["admin","madong","saas"],"labels":["high","madongadminsaas","multitenant","other","php","saas","webman"],"first_public_at":"2026-11-02T15:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120445","severity":null,"published_at":"2026-11-02T15:17:27+00:00","modified_at":"2026-11-02T15:17:27+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","fetched_at":"2026-11-02T15:24:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120445:1381","url":null,"severity":null,"published_at":"2026-11-02T15:27:47+00:00","modified_at":"2026-11-02T15:27:47+00:00","first_seen_at":"2026-11-02T15:27:47+00:00","fetched_at":"2026-11-02T15:27:47+00:00","note":"Read VulnCheck advisory and the vendor commit patch. Commit 2a199a1 (2026-11-02, closes issue #2) fixes it; no tagged release or fixed version found (releases page unreadable), so fixed version unknown. Nothing marked verified: the advisory is third-party and no vendor advisory/release was read."}],"documents":[{"id":52479,"url":"https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52480,"url":"https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-incorrect-authorization-via-platformapi-accesstokenmiddleware","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}