{"id":"CVE-2026-121552","kind":"vulnerability","aliases":["CVE-2026-121552"],"related":[],"title":"Dromara domain-admin: authenticated users can read other groups' member lists","description":"Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.","summary":"Dromara domain-admin versions before 1.6.79 let any logged-in user call the POST /api/getGroupUserList endpoint for groups they do not belong to. An attacker can walk through sequential group IDs to collect member usernames, leader and edit flags, and group owner usernames.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["domain-admin","dromara","other","self-hosted"],"not_affected_if":["single-user-deployment","version-1.6.79-or-later"],"how_to_check":"- Check the installed domain-admin version is below `1.6.79`\n- Review whether the `/api/getGroupUserList` handler checks group membership before returning data","fix":"- Upgrade domain-admin to `1.6.79` or later","status":"open","published_at":"2026-11-03T16:17:27+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","triaged_at":"2026-11-03T16:24:18+00:00","updated_at":"2026-11-03T16:24:18+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-03T16:24:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade domain-admin to `1.6.79` or later","reach":"network","title":"Dromara domain-admin: authenticated users can read other groups' member lists","impact":"low","summary":"Dromara domain-admin versions before 1.6.79 let any logged-in user call the POST /api/getGroupUserList endpoint for groups they do not belong to. An attacker can walk through sequential group IDs to collect member usernames, leader and edit flags, and group owner usernames.","audience":"businesses","category":"other","nicknames":[],"who_cares":["dromara","domain-admin","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users read member and owner names of other groups","analyst_note":"","how_to_check":"- Check the installed domain-admin version is below `1.6.79`\n- Review whether the `/api/getGroupUserList` handler checks group membership before returning data\n- unknown for other checks","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.6.79-or-later","single-user-deployment"],"who_is_affected":"Teams running Dromara domain-admin before 1.6.79 where ordinary logged-in users exist. The flaw needs an authenticated account but no special setting, and the exposure is limited to reading group membership data. Installations on 1.6.79 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":4181,"output_tokens":515,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121552':15A,18A '-2026':14A,17A '/api/getgroupuserlist':43B,86C '1.6.79':33B,77C 'admin':4A,21B,30B,75C 'allow':89C 'attack':53B,97C 'authent':5A,90C 'author':81C 'belong':50B,122C 'call':40B 'collect':61B 'contain':78C 'cve':13A,16A 'disclos':105C 'domain':3A,20B,29B,74C 'domain-admin':2A,19B,28B,73C 'dromara':1A,22B,27B,72C 'edit':66B,111C 'edit-permiss':110C 'endpoint':44B 'enumer':99C 'flag':67B,113C 'group':10A,46B,58B,69B,95C,101C,118C 'handler':87C 'host':26B 'id':59B,102C 'leader':64B,108C 'let':34B 'list':12A 'log':37B 'logged-in':36B 'member':11A,62B,96C,106C 'miss':80C 'owner':70B,115C 'permiss':112C 'post':42B,85C 'read':8A,93C 'self':25B 'self-host':24B 'sequenti':57B,100C 'user':6A,39B,91C 'usernam':63B,71B,107C,116C 'valu':103C 'version':31B 'vulner':82C 'walk':55B","nicknames":[],"mitigations":[],"who_affected":"Teams running Dromara domain-admin before 1.6.79 where ordinary logged-in users exist. The flaw needs an authenticated account but no special setting, and the exposure is limited to reading group membership data. Installations on 1.6.79 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["domainadmin","dromara","medium","other","selfhosted"],"first_public_at":"2026-11-03T16:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121552","severity":null,"published_at":"2026-11-03T16:17:27+00:00","modified_at":"2026-11-03T16:17:27+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","fetched_at":"2026-11-03T16:21:44+00:00","note":null}],"documents":[{"id":58840,"url":"https://github.com/dromara/domain-admin/commit/6245d002c995bf3868f73d77f69138df40f557a3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58841,"url":"https://www.vulncheck.com/advisories/domain-admin-before-1.6.79-missing-authorization-via-getgroupuserlist","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}