Threats tagged 'ghsa-rqh8-vfjg-c7gf'

madong-admin-saas versions through 5.1.4 have a critical missing authentication vulnerability in the platform tenant management API. The 'platformapi' middleware key does not properly match the 'platform' application, allowing unauthenticated remote attackers to access tenant management endpoints. Attackers can list, create, modify, disable, or delete tenants and bind subscription plans without authentication.