CVE-2026-120445 Details

A vulnerability allowing incorrect authorization has been identified in Madong Admin SaaS versions through 5.1.4. This issue resides in the AccessTokenMiddleware, where authenticated tenant users can access the platform management API in multi-tenant mode. The vulnerability allows attackers to reuse a tenant login JWT against platform API controllers to create platform administrator accounts, read tenant database settings, and take control of all tenants.

The platform 'AccessTokenMiddleware' should be modified to enforce a 403 response for any caller lacking the 'platform' type, regardless of the 'tenant.enable' configuration. Additionally, the '#[Middleware]' attribute should be restored on the 'AccountController' and 'TenantMemberByTenantController' to ensure proper authentication on tenant lifecycle endpoints. Finally, the platform authorization middleware should be added to the 'platformapi' group to prevent any controllers from being overlooked.