Jira Align CVE-2025-22176

Requires a valid authenticated low-privilege account on the target Jira Align instance (PR:L) - it is not a pre-authentication flaw. Given that account, exploitation needs only normal network access to the application and no user interaction or special configuration, since the affected endpoints fail to enforce role-based authorization. Limiting factors: the attacker must first obtain or possess account credentials, exploitation yields only a small amount of sensitive information (read-only confidentiality impact with no integrity or availability effect), and the exposure is scoped to specific restricted endpoints such as the audit log rather than full administrative access.

This is a genuinely low-to-moderate priority issue, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 medium score describe a network-reachable, low-complexity flaw that nonetheless requires an authenticated low-privilege account (PR:L), and impact is limited to low confidentiality only (VC:L, VI:N, VA:N) - no integrity or availability effect. EPSS corroborates low real-world risk at 0.21% (10th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not an active-exploitation priority. No SSVC decision data was supplied in the input. The consistent reading across all signals is a broken-access-control information-disclosure bug of limited blast radius: it is a legitimate issue to patch on a normal cycle, not an emergency. One caveat: the input tag 'Authentication Bypass' conflicts with the description and CWE-285 (an authorization/access-control flaw affecting an already-authenticated user), so treat the 'bypass' framing with caution - this is privilege-scoped data disclosure, not pre-auth access.

An attacker who already holds a valid low-privilege Jira Align account (for example a standard internal user or a contractor) directly requests administrative or restricted endpoints that should be blocked for their role, such as the audit log viewer. Because authorization is not properly enforced on those endpoints, the server returns a small amount of sensitive data the user should not see. No public exploit code is identified at time of analysis, and no user interaction or elevated privilege is required beyond the initial authenticated session.