CVE-2026-120445
Received Received - Intake

Incorrect Authorization in Madong-Admin-SaaS Allows Privilege Escalation

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120445

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
madong-code madong-admin-saas 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an incorrect authorization flaw in madong-admin-saas through version 5.1.4. It exists in the AccessTokenMiddleware component and allows authenticated tenant users to bypass authorization checks in multi-tenant mode. By reusing a tenant login JWT, attackers can access the platform management API via /platformapi endpoints to create platform administrator accounts, read tenant database settings, and take control of all tenants.

Detection Guidance

Check for unauthorized access to /platformapi endpoints by reviewing access logs for requests from tenant users to platform management APIs. Inspect JWT tokens for incorrect admin type claims or missing platform authorization. Verify middleware configuration in AccessTokenMiddleware.php for flawed conditional logic or commented-out attributes.

Impact Analysis

If you use madong-admin-saas in multi-tenant mode, an attacker with a valid tenant account could escalate privileges to platform administrator, access sensitive tenant data, create new admin accounts, or disable tenants. This could lead to complete platform compromise and data breaches across all tenants.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA. It enables unauthorized access to sensitive tenant data, which could result in data breaches, unauthorized disclosure of personal information, and failure to maintain proper access controls and audit trails.

Mitigation Strategies

Upgrade to the latest version of madong-admin-saas to apply the fixed AccessTokenMiddleware. Ensure middleware enforces platform admin type checks and restores missing #[Middleware] attributes. Review and correct JWT claim handling for admin types to prevent bypass.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120445. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...