CVE-2026-121552

Medium

Description

Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.

SeverityMedium

CVSS4.3

Exploit probability—

ProductDromara Domain-admin

PublishedNov 3, 2026

First seenNov 4, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

dromara domain-admin1.6.79 or later

Patches

github.com/dromara/domain-admin/commit/6245d002c995bf3868f73d77f69138df40f557a3

Affected products

Product	Affected versions	Fixed in
dromara domain-admin	v < 1.6.79	1.6.79

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.