madong-admin-saas vulnerabilities

2 known vulnerabilities in madong-admin-saas from Madong-code. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  madong-admin-saas: Missing Authentication for Critical Functionality

  CVE-2026-120446Nov 2, 2026Madong-codeEPSS 1.04%

  madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tena

• 8.8 High severity

  madong-admin-saas: Incorrect Authorization

  CVE-2026-120445Nov 2, 2026Madong-code

  madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platfo