5.3
Medium
CVE-2026-121552 Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList…
Description
Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| domain-admin 1.6 | earliest → < 1.6.79 | 1.6.79 |