Jira Align CVE-2025-22172

Requires a valid authenticated low-privilege Jira Align account (PR:L) with network access to the application; exploitation then succeeds against affected versions because specific endpoints lack proper authorization checks, allowing access to data such as external reports without the required permission. Limiting factors: the attacker must already possess valid low-privilege credentials, no privilege escalation or data modification is possible, and impact is confined to disclosure of a small amount of sensitive information (confidentiality only). No special non-default configuration is indicated as required.

This is a genuine-but-low-priority issue. All signals point the same direction: the CVSS 4.0 base score is 5.3 (MEDIUM) driven by AV:N/AC:L/PR:L/UI:N with only VC:L (low confidentiality) and no integrity or availability impact. EPSS is 0.21% (10th percentile), indicating very low probability of exploitation. There is no CISA KEV listing and no public POC identified, so no exploitation pressure. The vulnerability requires an already-authenticated low-privilege account (PR:L), which bounds the attacker population to existing authorized Jira Align users and limits impact to disclosure of a 'small amount of sensitive information' (e.g., reading external reports). No signals conflict - low EPSS, absent KEV, and modest CVSS all agree this is a real but minor broken-access-control flaw rather than an urgent threat. Note the input Tag 'Authentication Bypass' is inconsistent with the vendor description and CWE-285 (Improper Authorization): this is an authorization/access-control issue, not authentication bypass, since the attacker is already authenticated.

A legitimate low-privilege Jira Align user (or an attacker who has phished/obtained such an account) browses or guesses endpoint paths that are not protected by proper permission checks. By requesting these endpoints directly, they view data they should not have access to - for example, reading external reports - resulting in limited disclosure of sensitive information. No public exploit code is required, as the flaw is simply missing authorization enforcement.