Live › vulnerability › CVE-2026-121552
Dromara domain-admin versions before 1.6.79 let any logged-in user call the POST /api/getGroupUserList endpoint for groups they do not belong to. An attacker can walk through sequential group IDs to collect member usernames, leader and edit flags, and group owner usernames.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Teams running Dromara domain-admin before 1.6.79 where ordinary logged-in users exist. The flaw needs an authenticated account but no special setting, and the exposure is limited to reading group membership data. Installations on 1.6.79 or later are not affected.
No product ranges from the sources yet.
1.6.79/api/getGroupUserList handler checks group membership before returning data1.6.79 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.
This page as .md · .json · in your agent: get_signal("CVE-2026-121552")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.