Jira Align CVE-2025-22175

Requires a valid authenticated low-privilege Jira Align user account (PR:L); the flaw is an object-level authorization gap on specific endpoints that fail to verify ownership, letting that user reach resources belonging to other users (e.g., another user's private checklist). No special product configuration, feature toggle, or deployment mode is cited in the advisory - it affects standard operation. The primary limiting factor is the authentication requirement: an attacker must already possess credentials on the target Jira Align instance, so there is no unauthenticated or anonymous exploitation path. No user interaction by the victim is required.

This is a moderate-severity broken-authorization (CWE-285) flaw rated CVSS 5.3 (official vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L). All signals point to a low-priority, low-urgency issue rather than an emergency. The attack vector is network-based with low complexity, but exploitation requires an existing low-privilege authenticated account (PR:L), which sharply limits the attacker population to insiders or anyone who can obtain a valid low-level login. EPSS is 0.18% (6th percentile), indicating very low predicted exploitation probability, and there is no CISA KEV listing and no identified public exploit code - the signals are consistent with each other (low EPSS, no KEV, no POC all agree this is not under active attack). One notable internal conflict: the official CVSS 4.0 vector sets VC:N (no confidentiality impact), yet the NVD description explicitly states the flaw 'disclose[s] a small amount of sensitive information.' These disagree - the vector captures only the integrity impact (modifying another user's checklist) while the prose claims a confidentiality impact as well; this suggests the true impact is both limited confidentiality AND integrity, and the scored vector may understate confidentiality. Verify scope of disclosed data with Atlassian. Net: genuine but low-to-moderate priority, driven by limited technical impact and a required authenticated foothold.

A user holding a legitimate low-privilege Jira Align account enumerates or directly requests endpoints that lack proper per-object authorization checks, allowing them to read a small amount of another user's sensitive data and, as the vendor example shows, modify the steps of another user's private checklist. No public exploit code has been identified, so exploitation would require an attacker to discover the vulnerable endpoints themselves. Because the attack is network-reachable with low complexity (AV:N/AC:L) but needs valid low-level credentials (PR:L), the realistic threat actor is a malicious or compromised authenticated tenant user.