Jira Align CVE-2025-22173

Requires a valid authenticated Jira Align account with a low-privilege role (reflected in PR:L); exploitation is not possible for unauthenticated/anonymous users. The attacker must reach specific under-protected endpoints that expose data such as sprint information without enforcing the required permission. Limiting factors: a working low-privilege login is mandatory, the impact is confined to disclosure of a small amount of sensitive data (no modification or disruption), and knowledge of the vulnerable endpoint paths is needed. No non-default configuration or user interaction is required (UI:N).

This is a moderate-severity improper authorization flaw (CWE-285) with a vendor-assigned CVSS 4.0 base score of 5.3, driven by AV:N/AC:L/PR:L/UI:N and limited confidentiality-only impact (VC:L, with VI:N/VA:N). All signals point to a low real-world priority rather than an urgent threat: EPSS is 0.21% (10th percentile), indicating very low predicted exploitation probability; the CVE is not listed in CISA KEV; and no public proof-of-concept was provided in the intelligence. The CVSS vector itself confirms modest risk - exploitation requires an already-authenticated low-privilege account (PR:L), not an anonymous remote attacker, and the outcome is disclosure of 'a small amount of sensitive information' with no integrity or availability impact. There is no conflicting data here: every source (vendor CVSS, EPSS, absent KEV, absent POC) is consistent in describing a low-to-moderate, authenticated information-disclosure issue. The main caveat is that the only reference is the vendor ticket (JIRAALIGN-8642) behind Atlassian's tracker, so affected-version granularity and fixed builds are not independently verifiable from the supplied data.

An authenticated user holding a low-privilege role in Jira Align browses or directly requests application endpoints that are not properly access-controlled and retrieves data they should not be able to see - for example, sprint information belonging to teams or programs outside their authorized scope. No public exploit code is available, and because the flaw is a missing authorization check, exploitation requires only a valid low-privilege session and knowledge of the affected endpoints (AC:L), with no special tooling.