Threats tagged 'ghsa-hqqg-4j3f-xj8v'

Dromara domain-admin versions prior to 1.6.79 have a missing authorization vulnerability in the POST /api/getGroupUserList endpoint. This flaw allows authenticated users to access member information of groups they do not belong to by enumerating group IDs. The exposed data includes usernames of members, leader and edit-permission flags, and owner usernames. The vulnerability has a medium severity with a CVSS score of 4.3.