Jira Align CVE-2025-22171

Exploitation requires an authenticated Jira Align account with at least low-privilege access to the target instance (PR:L) - it is not exploitable by anonymous/unauthenticated attackers. No user interaction from the victim is needed (UI:N) and no special non-default feature toggle is indicated; the flaw lies in the standard checklist functionality's missing ownership/authorization check. The primary limiting factor is the need for valid low-privilege credentials on the same Jira Align tenant, which confines exploitation to insiders or attackers who have already obtained a foothold account; impact is further bounded to modifying other users' private checklists (integrity only), with no confidentiality or availability consequences.

This is a genuinely low-priority issue despite being a real authorization flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) scores 5.3 and tells a consistent story: network-reachable and low-complexity, but requiring an authenticated low-privilege account (PR:L) and yielding only limited integrity impact (VI:L) with zero confidentiality or availability impact. The practical consequence - a low-privilege user tampering with other users' private checklists - is a horizontal access-control (IDOR-style) problem, not a path to code execution or data exfiltration. The EPSS score of 0.19% (8th percentile) reinforces low real-world exploitation likelihood, and there is no CISA KEV listing and no public exploit code, so the signals are mutually consistent rather than conflicting. One data-quality caveat: the input Tags label this 'Authentication Bypass,' which contradicts CWE-285 (Improper Authorization) and the description - this is an authorization/access-control defect, not an authentication bypass, so that tag should not drive triage. Net assessment: legitimate bug worth patching in routine cycles, but not an urgent, widely-weaponizable threat.

An authenticated low-privilege Jira Align user issues requests referencing checklist objects owned by other users and, because the application fails to enforce per-user ownership, is able to modify those victims' private checklists. No public proof-of-concept is available, but exploitation is technically simple (AC:L) for anyone with a valid low-privilege account on the target tenant. Impact is limited to unauthorized modification of other users' checklist data (integrity), with no disclosure or service disruption.