Jira Align CVE-2025-22168

Requires a valid authenticated low-privilege account on the target Jira Align instance (PR:L); exploitation is remote over the network (AV:N) with low complexity (AC:L) and no user interaction. The limiting factors are that the attacker must already hold tenant credentials and that each access yields only a small amount of another user's sensitive data (e.g. private checklist steps) - there is no integrity or availability impact and no privilege escalation. No special non-default configuration is named in the advisory.

This is a genuinely low-risk authorization flaw (CWE-285 improper authorization) despite being an enterprise Atlassian product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L, score 5.3) and the description agree: an authenticated low-privilege user (PR:L) can reach endpoints that leak a 'small amount of sensitive information' such as another user's private checklist steps - confidentiality-only (VC:L), no integrity or availability impact. EPSS is 0.21% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not under active or probable mass exploitation. SSVC-wise: exploitation status is none, technical impact is partial, and automatability is low given it requires valid authenticated access and the payoff is minor data disclosure. The only mild conflict is the input Tag 'Authentication Bypass', which contradicts both the CWE (authorization, not authentication) and the vector (PR:L confirms the attacker is already authenticated) - this is an authorization/IDOR issue, not an auth bypass. Treat as a routine patch-cycle item, not a priority.

A legitimate low-privilege Jira Align user, already logged into the tenant, manipulates or directly requests endpoints they are not meant to reach (e.g. the checklist of another user) and receives sensitive data belonging to other users. No exploit code is public; exploitation is trivial technically (AC:L) but gated by needing a valid low-privilege account and yields only a small amount of information per request.