madong-admin-saas incorrect authorization lets tenant users reach the platform admin API
In a management program shared by several companies, ordinary users can become full admins.
Summary
An incorrect authorization flaw in the madong-admin-saas access token middleware lets logged-in tenant users reach the platform management API. In multi-tenant mode, an attacker can create platform administrator accounts and take control of every tenant. Versions through 5.1.4 are affected.
Affected when
- multi-tenant mode enabled
- a tenant user login account
What to do
Check that you run a version newer than 5.1.4, and read the vendor's advisory. The source does not name a fixed version.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen