CVE-2026-121552: domain-admin before 1.6.79 Missing Authorization via getGroupUserList
Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential groupid values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Dromara domain-admin versions before 1.6.79 are affected if authenticated users can reach the POST /api/getGroupUserList handler.
What access does an attacker need?
An attacker needs an authenticated account with low-level user privileges. No user interaction is required, and the attacker can enumerate sequential group_id values to query groups they do not belong to.
What information can be disclosed?
The affected handler can disclose usernames of group members, group leaders, users with edit permissions, and group owners for unauthorized groups.
How can defenders check for exposure?
Verify the deployed domain-admin version and review whether authenticated users can submit POST requests to /api/getGroupUserList with group_id values for groups outside their membership. Successful responses containing member or owner details for unrelated groups indicate exposure.