Incorrect Authorization Vulnerability in madong-admin-saas Affected by AccessTokenMiddleware

CVE-2026-120445

What is CVE-2026-120445?

The madong-admin-saas application, up to version 5.1.4, has a vulnerability in the AccessTokenMiddleware that permits authenticated tenant users to access management APIs intended for platform administrators. This vulnerability allows attackers to exploit tenant JWTs for unauthorized access, potentially enabling the creation of admin accounts, extraction of database configurations, and overall compromise of tenant environments. Proper validation of access tokens and enhanced authorization checks are crucial for mitigating this risk.

References