Madong-admin-saas CVEs and Security Vulnerabilities

CVE-2026-120446

madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API

madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.

CVSS 4.0 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Madong-code

Products

Madong-admin-saas

CVE-2026-120445

madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware

madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed