Jira Align CVE-2025-22169

Requires a valid authenticated Jira Align account at a low privilege level (PR:L); the flaw is that per-endpoint authorization checks are missing or insufficient, allowing that account to reach endpoints and actions (e.g. subscribing to an item/object) reserved for higher-privilege roles. Limiting factors: exploitation is impossible for fully unauthenticated attackers, requires no special non-default configuration per the description, and yields only a small amount of sensitive information with no write/integrity or availability impact, bounding realistic risk well below the network-exposure implied by AV:N alone.

This is a genuinely low-priority, low-real-risk issue despite being a valid flaw. All signals align toward low urgency: the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L, remaining impacts N) yields a 5.3 Medium, EPSS is 0.18% (6th percentile - very low predicted exploitation), there is no CISA KEV listing, and no public exploit code was identified. The vector confirms exploitation requires an authenticated low-privilege account (PR:L), and the impact is limited to partial confidentiality loss of 'a small amount of sensitive information' with no integrity or availability impact. No conflicting signals exist between the CVSS metrics and the description - both describe a network-reachable, low-complexity authorization (CWE-285) weakness exploitable by an existing authenticated user. SSVC-style framing would place this at low/track: technical impact is partial, automatability is low (requires valid credentials and offers only minor disclosure), and there is no evidence of active exploitation. The one notable metadata inconsistency is the 'Authentication Bypass' tag, which does not match CWE-285 (improper authorization) or the description - this is an authorization/access-control flaw, not an authentication bypass.

An authenticated low-privilege Jira Align user (e.g. a standard team member) sends requests to endpoints that should be restricted to higher-privilege roles, such as subscribing to an item/object they lack permission for, and thereby views a small amount of sensitive information they should not see. Exploitation is network-based and low-complexity but requires a valid low-privilege account; no public proof-of-concept was identified at time of analysis.