{"id":"CVE-2026-120445","title":"madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware","summary":"madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant lo…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-863"],"vendor":"madong-code","product":"madong-admin-saas","affected":["madong-admin-saas <= 5.1.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-02T15:54:25.850369Z"},"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T15:54:37.704Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120445","references":[{"url":"https://github.com/madong-code/madong-admin-saas/issues/2"},{"url":"https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39"},{"url":"https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/app/platform/middleware/AccessTokenMiddleware.php#L62-L73"},{"url":"https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-incorrect-authorization-via-platformapi-accesstokenmiddleware","label":"VulnCheck Advisory: madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware"}],"tags":["cve.org"],"epss":0.00355,"epssPercentile":0.2936,"ingestedAt":"2026-11-05T19:30:42.697Z","slug":"CVE-2026-120445","body":"## Overview\n\nmadong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.\n\n## Affected\n\n- `madong-admin-saas <= 5.1.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}