---
id: CVE-2026-120445
title: >-
  madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi
  AccessTokenMiddleware
summary: >-
  madong-admin-saas through 5.1.4 contains an incorrect authorization
  vulnerability in AccessTokenMiddleware that allows authenticated tenant users
  to access the platform management API in multi-tenant mode. Attackers can
  reuse a tenant lo…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-863
vendor: madong-code
product: madong-admin-saas
affected:
  - madong-admin-saas <= 5.1.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-02T15:54:25.850369Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T15:54:37.704Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120445'
references:
  - url: 'https://github.com/madong-code/madong-admin-saas/issues/2'
  - url: >-
      https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39
  - url: >-
      https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/app/platform/middleware/AccessTokenMiddleware.php#L62-L73
  - url: >-
      https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-incorrect-authorization-via-platformapi-accesstokenmiddleware
    label: >-
      VulnCheck Advisory: madong-admin-saas through 5.1.4 Incorrect
      Authorization via /platformapi AccessTokenMiddleware
tags:
  - cve.org
epss: 0.00355
epssPercentile: 0.2936
ingestedAt: '2026-11-05T19:30:42.697Z'
---

## Overview

madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.

## Affected

- `madong-admin-saas <= 5.1.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.