CVE-2026-120445 — Vulnerability intelligence
—
Published:
- CVSS
- 8.7
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.