Threats affecting pkg:github/madong-admin-saas

madong-admin-saas versions up to 5.1.4 have a missing authentication vulnerability in the platform tenant management API. This flaw allows unauthenticated remote attackers to access critical endpoints such as /platformapi/tenant/account, bind-plan, and sync-data. Exploitation enables attackers to list, create, modify, disable, or delete tenants and bind subscription plans without any authentication.

madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.