Jira Align CVE-2025-22174

Exploitation requires a valid authenticated Jira Align account at a low privilege level (PR:L); it is not reachable by fully unauthenticated attackers. The attacker then accesses specific endpoints that lack proper authorization enforcement - the description cites viewing portfolio rooms without the required permission as a concrete example. No user interaction, special configuration, or non-default deployment mode is needed (UI:N, AC:L), and impact is limited to disclosure of a small amount of sensitive information (confidentiality only). The primary limiting factor is the need for prior valid low-privilege credentials, which confines realistic exploitation to insiders, compromised accounts, or multi-tenant environments granting broad low-trust access.

This is a low-to-moderate priority issue that should not be over-prioritized despite its CVSS 5.3 (4.0) rating. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) shows a network-reachable, low-complexity flaw but one that requires an already-authenticated low-privilege account (PR:L) and yields only low confidentiality impact (VC:L) with zero integrity or availability impact - consistent with the description's 'small amount of sensitive information' disclosure. EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit was identified, so all exploitation signals point the same direction: no evidence of widespread or opportunistic attack interest. These signals are mutually consistent rather than conflicting. The one cross-source discrepancy is the 'Authentication Bypass' tag, which does not match the CVE's actual nature: both the description and CWE-285 (Improper Authorization) describe a post-authentication access-control/authorization failure, not a bypass of authentication itself. Net assessment: a genuine but limited broken-access-control information-disclosure bug, meaningful for multi-tenant/enterprise Jira Align deployments with many low-trust users, but not an urgent mass-exploitation threat.

An attacker who already holds a legitimate low-privilege Jira Align account (for example, a basic team member) sends requests to endpoints they are not authorized to reach and receives sensitive data - such as viewing portfolio rooms - without the required permission. Because the attack is network-based with low complexity (AV:N/AC:L) but needs valid low-level credentials (PR:L) and no user interaction, exploitation is simple for any insider or compromised account. No public exploit code was identified at the time of analysis.