The vulnerability resides in the AccessTokenMiddleware of madong-admin-saas up to version 5.1.4. The middleware incorrectly validates JWTs, allowing any authenticated tenant user to invoke platform‑level API endpoints. This misuse enables attackers to create new platform administrator accounts, read sensitive tenant configuration data, and ultimately take full control of every tenant in the system. The weakness corresponds to the CWE-863 category of improper authorization. The impact is a high‑severity privilege escalation that compromises confidentiality, integrity, and availability of all tenant data. Attackers must possess a valid tenant login JWT; once possessed, they can repeat the request against /platformapi controllers without requiring additional permissions. This condition fosters a broad attack surface in multi‑tenant deployments.

This issue affects the madong-code:madong-admin-saas product, specifically all releases up through 5.1.4. The flaw is present only when the application operates in multi‑tenant mode, where tenant users normally have isolated privileges. No earlier or later releases are mentioned as affected.

The CVSS score of 8.7 indicates a high severity gap between the compromised tenant user and the platform owner. The EPSS is not available, so the statistical exploitation probability cannot be quantified, but the vulnerability is practically exploitable by any tenant with a valid JWT, which is typically trivial to obtain once a tenant account exists. The absence from the CISA KEV catalog does not diminish the risk; the flaw remains publicly observable through the repository’s commit history and issue discussion. The likely attack vector is an authenticated request from a tenant user, reusing their login token against administrative endpoints. Once the exploit is activated, an attacker can insert new admin accounts, read database settings, and gain complete control across all tenants. The risk is therefore high for any environment that hosts multiple tenants without additional authorization segregation.