madong-admin-saas CVE-2026-120445

Two concrete prerequisites, both drawn from the patched code and description: (1) the instance must be deployed in multi-tenant mode - specifically config('tenant.enable') must be true, since the vulnerable branch only skipped the platform-admin-type check in that configuration; and (2) the attacker must possess a valid tenant login JWT (a legitimate low-privilege tenant account, matching PR:L), which is then replayed against the /platformapi controllers. Limiting factors that reduce real-world exposure: single-tenant/monolithic deployments are NOT affected because non-platform tokens are correctly rejected when tenant.enable is not true; exploitation requires an authenticated tenant credential rather than fully anonymous access; and it is bounded to madong-admin-saas versions through 5.1.4.

This is a genuine high-priority access-control flaw (CWE-863) rather than an inflated high-CVSS issue, but its reach is gated by deployment mode. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) and score 8.7 describe a remotely reachable, low-complexity attack by an already-authenticated low-privilege tenant user that yields full confidentiality, integrity and availability impact on the platform - consistent with the description (create platform admin accounts, read tenant DB settings, take over every tenant). PR:L correctly reflects that a valid tenant login JWT is required, so this is authenticated, not unauthenticated. No EPSS score and no KEV listing were provided, and no confirmed exploit code is present (only a vendor issue, the patch commit, a source-line reference, and a VulnCheck advisory), so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals point to a credible, high-impact bug disclosed with a patch rather than a mass-exploited threat. The one conflicting/limiting signal to verify is deployment-dependence: the patched code shows the flaw only manifests when multi-tenant mode (config('tenant.enable') === true) is enabled, so single-tenant/monolithic installs are not exposed; the VulnCheck decision label is 'this_week', which matches patch-promptly urgency rather than emergency.

An attacker who holds (or registers) an ordinary tenant account on a madong-admin-saas instance running in multi-tenant mode logs in normally and obtains a tenant JWT. They replay that same token against the /platformapi platform-management controllers, which - due to the authorization defect - accept it, letting them create a platform administrator account and read every tenant's database configuration. No public working exploit code is identified at time of analysis; the attack requires only a valid tenant credential and low complexity (AC:L).