CVE-2026-121552— domain-admin before 1.6.79 Missing Authorization via getGroupUserList

Quick assessment

Affected

dromara domain-admin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dromara 的 domain-admin 模块在 1.6.79 版本之前存在一个授权缺失漏洞，该漏洞位于 POST /api/getGroupUserList 接口处理程序中，允许已认证用户读取其他组的成员信息。攻击者可以通过枚举连续的 group_id 值，泄露其所属组之外的组的成员用户名、组长身份、编辑权限标志以及所有者用户名。

CVSS 4.3 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1087 · Account Discovery

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

domain-admin before 1.6.79 Missing Authorization via getGroupUserList

Source: CVE Program / CVE List V5

Vulnerability Description

Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
dromara	domain-admin	0 ~ 1.6.79	-

II. Public POCs for CVE-2026-121552

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121552

请登录查看更多情报信息。

Other References for CVE-2026-121552 (5)

https://github.com/dromara/domain-admin product
https://github.com/dromara/domain-admin/blob/v1.6.78/domain_admin/api/group_user_api.py#L127 technical-description
https://github.com/dromara/domain-admin/commit/6245d002c995bf3868f73d77f69138df40f557a3 patch
https://github.com/dromara/domain-admin/issues/229 issue-tracking
https://www.vulncheck.com/advisories/domain-admin-before-1.6.79-missing-authorization-via-getgroupuserlist third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121552

IV. Related Vulnerabilities

Same vendor: dromara

Same weakness: CWE-862