CVE-2026-121552

Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential groupid values to disclose member usernames, leader and edit-permission...

CVE-2026-121552

Dromara domain-admin versions prior to 1.6.79 are vulnerable to a missing authorization vulnerability (CWE-862) within the POST /api/getGroupUserList handler. This flaw allows authenticated users to access group membership details for groups they do not belong to by enumerating sequential group_i...

EUVD-2026-115897

Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential groupid values to disclose member usernames, leader and edit-permission...

CVE-2026-121552 domain-admin before 1.6.79 Missing Authorization via getGroupUserList

Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential groupid values to disclose member usernames, leader and edit-permission...

CVE-2026-121552: dromara domain-admin: Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList…

Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential groupid values to disclose member usernames, leader and edit-permission...