Is CVE-2026-120445 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-120445?

CVE-2026-120445 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-120445

Description

madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.