Madong Admin Saas
Monthly
Madong Admin SaaS through 5.1.4 exposes its platform tenant-management API without authentication because the shipped middleware configuration registers the platform access-token middleware under the key 'platformapi' instead of the webman application key 'platform', so calls to /platformapi/tenant/account, /platformapi/tenant/bind-plan and /platformapi/tenant/sync-data reach controller actions with no identity check. Remote unauthenticated attackers who can reach the platform API can therefore list, create, modify, disable or delete tenants and bind subscription plans. The vendor has published an upstream fix, the issue is high severity (CVSS 8.8), and no public exploit was identified at time of analysis.
Incorrect authorization in madong-admin-saas through 5.1.4 lets a tenant user replay their login JWT against /platformapi controllers in multi-tenant deployments, where the middleware's platform-admin type check was skipped, allowing creation of platform administrator accounts, reading of tenant database settings, and control over every tenant. Only instances running with multi-tenant mode enabled (config('tenant.enable') true) are exposed; single-tenant deployments reject non-platform tokens correctly. Exploitation requires a valid low-privilege tenant account (PR:L per the assessed vector), and no public exploit code has been identified at time of analysis; the vendor patch is available as an upstream commit.
Madong Admin SaaS through 5.1.4 exposes its platform tenant-management API without authentication because the shipped middleware configuration registers the platform access-token middleware under the key 'platformapi' instead of the webman application key 'platform', so calls to /platformapi/tenant/account, /platformapi/tenant/bind-plan and /platformapi/tenant/sync-data reach controller actions with no identity check. Remote unauthenticated attackers who can reach the platform API can therefore list, create, modify, disable or delete tenants and bind subscription plans. The vendor has published an upstream fix, the issue is high severity (CVSS 8.8), and no public exploit was identified at time of analysis.
Incorrect authorization in madong-admin-saas through 5.1.4 lets a tenant user replay their login JWT against /platformapi controllers in multi-tenant deployments, where the middleware's platform-admin type check was skipped, allowing creation of platform administrator accounts, reading of tenant database settings, and control over every tenant. Only instances running with multi-tenant mode enabled (config('tenant.enable') true) are exposed; single-tenant deployments reject non-platform tokens correctly. Exploitation requires a valid low-privilege tenant account (PR:L per the assessed vector), and no public exploit code has been identified at time of analysis; the vendor patch is available as an upstream commit.