CVE-2026-120445

madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.

Enables privilege escalation from tenant level to platform level and takeover of all tenants. May result in mass data breach and full compromise of the multi-tenant environment.

Update madong-admin-saas to a version newer than 5.1.4 if available, or fix AccessTokenMiddleware to properly distinguish tenant tokens from platform tokens. Enforce strict authorization checks for /platformapi endpoints.