---
id: "CVE-2026-120445"
kind: "vulnerability"
aliases: ["CVE-2026-120445"]
title: "madong-admin-saas: tenant login token reaches platform admin API"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "madong-admin-saas", "fixed": [], "affected": "<= 5.1.4", "ecosystem": "other"}]
ecosystems: []
tags: ["madong-admin-saas", "multi-tenant", "other", "php", "saas", "webman"]
not_affected_if: ["single-tenant"]
published_at: "2026-11-02T15:17:27+00:00"
first_seen_at: "2026-11-02T15:24:02+00:00"
updated_at: "2026-11-02T15:27:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120445", "first_seen_at": "2026-11-02T15:24:02+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T15:27:47+00:00"}]
---

# madong-admin-saas: tenant login token reaches platform admin API

madong-admin-saas through 5.1.4 has an authorization flaw: in multi-tenant mode the platform AccessTokenMiddleware did not reject tenant tokens, so a logged-in tenant user can call the platform management API with their tenant JWT. VulnCheck says this allows creating platform admin accounts, reading tenant database settings and taking over every tenant. Upstream fixed it in a commit on 2 Nov 2026; no fixed release version is named.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:madong-admin-saas affected <= 5.1.4 fixed ?

## How to check

- Versions up to and including 5.1.4 are listed as affected; only multi-tenant mode (tenant.enable = true) is described as exposed.
- In app/platform/middleware/AccessTokenMiddleware.php, vulnerable code only rejects non-platform tokens when config('tenant.enable') !== true. The fix checks for the platform or root admin type unconditionally.
- In config/middleware.php, the platform middleware group is keyed 'platformapi' (vulnerable; it does not take effect). The fix keys it 'platform' and attaches AccessTokenMiddleware to the group.
- How to read the installed version: unknown, the sources do not say.

## Fix

Upstream fixed it in commit 2a199a1523ed749c94b876bc2ae5fedf252b2e39 (2 Nov 2026); no release version containing it is named in the sources. Until a release is tagged, update to a build that includes that commit, or apply the patch to app/platform/middleware/AccessTokenMiddleware.php and config/middleware.php.

## Timeline

- 2026-11-02T15:24:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120445
- 2026-11-02T15:27:47+00:00 analyst — Read VulnCheck advisory and the vendor commit patch. Commit 2a199a1 (2026-11-02, closes issue #2) fixes it; no tagged release or fixed version found (releases page unreadable), so fixed version unknown. Nothing marked verified: the advisory is third-party and no vendor advisory/release was read.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-incorrect-authorization-via-platformapi-accesstokenmiddleware
- [fix] Patch: github.com https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39

## From the sources

madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_