Is CVE-2026-121552 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121552?

CVE-2026-121552 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-121552

Description

Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.