CVE-2026-121552

Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential groupid values to disclose member usernames, leader and edit-permission...

CVE-2026-121552 domain-admin before 1.6.79 Missing Authorization via getGroupUserList

Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential groupid values to disclose member usernames, leader and edit-permission...

CVE-2026-121552: dromara domain-admin: Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList…

Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential groupid values to disclose member usernames, leader and edit-permission...