Dromara domain-admin CVE-2026-121552

Exploitation requires a valid authenticated account on the target domain-admin instance (any low-privileged user suffices, per PR:L); the attacker then calls the POST /api/getGroupUserList endpoint with group_id values for groups they are not a member of. No special feature toggle or non-default configuration is needed - the flaw is in the default code path of versions before 1.6.79, where the handler performed no group-membership permission check. The limiting factor is the authentication requirement: unauthenticated outsiders cannot reach it, and the disclosed data is group membership metadata (usernames, leader/edit flags, owner usernames), not passwords or secrets.

This is a moderate, authorization-layer information-disclosure issue, not a high-urgency flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, base 5.3) is internally consistent with the description: network-reachable, low attack complexity, but requiring an already-authenticated low-privileged account (PR:L), and yielding only low confidentiality impact with no integrity or availability effect. The vuln.today decision label is 'this_month' rather than act_now/emergency, which aligns with a read-only disclosure of non-credential metadata. There is no CISA KEV listing and no EPSS score supplied, so there is no signal of active or probable exploitation; absence of EPSS/KEV is not itself a finding but means widespread-exploitation probability cannot be quantified from this data. The references include a GitHub issue (#229) and a VulnCheck advisory, but none is labeled as confirmed working exploit code, so this should be treated as a disclosed, patched authorization gap rather than a weaponized threat. Net: a genuine but low-severity IDOR-style enumeration bug - worth patching on a normal cycle, not an emergency.

An attacker who already holds any valid low-privileged account in a Dromara domain-admin instance sends POST requests to /api/getGroupUserList while iterating sequential group_id values. Because the handler never checks group membership, the attacker harvests member usernames, leader and edit-permission flags, and owner usernames for groups they do not belong to. No public exploit is identified at time of analysis, but the technique is trivial scripted enumeration requiring only an authenticated session.