CVE-2018-19110: Tianti Project Tianti

Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days.

The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/skin/list directly because controller\usercontroller.java maps a /skin/list request to the function skinList, and lacks an authorization check.

Affected products

• Tianti Project Tianti: version 2.3 only

Published 2018-11-08. Last modified 2026-06-17.