CVE-2026-121552 Details
Description
Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.
A missing authorization vulnerability has been identified in Dromara Domain-Admin versions prior to 1.6.79. The issue resides in the POST /api/getGroupUserList endpoint, where authenticated users can access the member lists of other groups. This vulnerability allows users to enumerate group IDs and retrieve usernames, leadership and edit-permission statuses, and owner usernames for groups they do not belong to.
Users can update to Dromara Domain-Admin version 1.6.79 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dromara/domain-admin/issues/229 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/dromara/domain-admin | [email protected] | ProductVendor |
| https://github.com/dromara/domain-admin/blob/v1.6.78/domain_admin/api/group_user_api.py#L127 | [email protected] | Source CodeVendor |
| https://github.com/dromara/domain-admin/commit/6245d002c995bf3868f73d77f69138df40f557a3 | [email protected] | Source CodeVendor |
| https://github.com/dromara/domain-admin/issues/229 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/domain-admin-before-1.6.79-missing-authorization-via-getgroupuserlist | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dromara domain-admin | >= 0, < 1.6.79 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |