CVE-2026-121552 in domain-admin
Summary
by MITRE • 11/03/2026
Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The Dromara domain-admin framework prior to version 1.6.79 suffers from a critical missing authorization vulnerability within its API endpoint responsible for retrieving group user lists. This flaw specifically affects the POST /api/getGroupUserList handler, which is designed to return membership details for administrative groups. The core technical deficiency lies in the server-side logic that fails to validate whether the authenticated user initiating the request possesses the necessary permissions or belongs to the specific group identified by the provided identifier. Instead of enforcing strict access control checks against the requesting identity and the target resource, the application blindly processes requests based solely on the supplied parameters, allowing any logged-in account to query data associated with arbitrary groups regardless of their membership status.
This architectural oversight enables attackers to perform unauthorized information disclosure through a technique known as group enumeration. By systematically iterating through sequential integer values for the group_id parameter in API calls, an attacker can traverse the database and extract sensitive metadata from every accessible or misconfigured group within the system. The vulnerability exposes not only basic member usernames but also privileged attributes such as leader designations, edit-permission flags indicating administrative capabilities, and owner usernames. This granular level of detail provides a comprehensive map of the organization's internal structure, revealing roles, responsibilities, and potential high-value targets for further exploitation without requiring any elevation of privilege beyond initial authentication.
The operational impact of this vulnerability is significant as it facilitates reconnaissance activities that are typically required before launching more severe attacks such as account takeover or lateral movement within an enterprise environment. By obtaining a list of group owners and leaders with edit permissions, attackers can identify individuals who likely hold administrative rights over systems or data stores linked to those groups. This information allows for targeted phishing campaigns, credential stuffing attempts focused on privileged accounts, or the exploitation of other vulnerabilities specific to the identified roles. The ability to map out permission structures effectively neutralizes the security boundary between different user segments, turning a standard authenticated session into a powerful tool for internal network mapping and privilege escalation planning.
From a classification perspective, this issue aligns with CWE-285 Improper Authorization, as the application fails to enforce proper access controls on sensitive resources. It also corresponds to ATT&CK technique T1087 Account Discovery, where adversaries enumerate accounts within their current environment to identify potential targets for further exploitation. The sequential enumeration aspect relates to CWE-346 Originating Resource Misrepresentation in terms of trusting input without validation, though the primary failure is strictly authorization-related rather than injection-based.
To mitigate this vulnerability, organizations running versions of Dromara domain-admin earlier than 1.6.79 must upgrade immediately to version 1.6.79 or later where the issue has been resolved. In cases where immediate patching is not feasible, administrators should implement a web application firewall rule that restricts access to the /api/getGroupUserList endpoint based on IP reputation or rate limiting to slow down enumeration attempts. Additionally, implementing strict server-side authorization checks that verify the requesting user's membership in the target group before returning any data is essential for preventing similar flaws if custom modifications have been made to the framework code. Regular security audits and penetration testing focusing on broken access control patterns are recommended to ensure no other endpoints suffer from analogous deficiencies.