CVE-2026-121552
Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows auth
CVSS
4.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 3, 2026 · Last modified: Nov 3, 2026 · CWE-862
Not enough EPSS history yet.
Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.
- github.comhttps://github.com/dromara/domain-admin
- github.comhttps://github.com/dromara/domain-admin/blob/v1.6.78/domain_admin/api/group_user_api.py#L127
- github.comhttps://github.com/dromara/domain-admin/commit/6245d002c995bf3868f73d77f69138df40f557a3
- github.comhttps://github.com/dromara/domain-admin/issues/229
- www.vulncheck.comhttps://www.vulncheck.com/advisories/domain-admin-before-1.6.79-missing-authorization-via-getgroupuserlist
- github.comhttps://github.com/dromara/domain-admin/issues/229
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-970724.3 MED—
———Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.5hCVE-2026-397774.3 MED—
———Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.5hCVE-2026-397435.3 MED—
———Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.5hCVE-2026-1208465.3 MED—
———Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 7.7.1.5hCVE-2026-1195095.3 MED—
———Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from n/a through 3.3.0.5hCVE-2026-1194955.3 MED—
———Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2.5h