PT-2026-136226
CVE-2026-121552
·
Published
2026-11-03
·
Updated
2026-11-03
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾