Threats tagged 'ghsa-rj3r-2pcr-8jf9'

madong-admin-saas versions through 5.1.4 have an incorrect authorization vulnerability in AccessTokenMiddleware. This flaw allows authenticated tenant users in multi-tenant mode to access platform management APIs improperly. Exploitation enables attackers to reuse tenant login JWTs to create platform administrator accounts, read tenant database settings, and gain control over all tenants.