Jira Align CVE-2025-22177

Exploitation requires a valid authenticated Jira Align account at low privilege level (confirmed by PR:L); no administrative rights, user interaction, or special configuration is needed, and the flawed endpoints are reachable over the network. The key limiting factor is the authentication requirement - an attacker must already possess or obtain low-privilege credentials, which makes this most relevant to insider or compromised-account scenarios rather than anonymous external attackers. Impact is further bounded to disclosure of a small amount of sensitive data (e.g., other teams' overviews), with no write, modification, or availability impact.

This is a genuine but low-severity authorization flaw (CWE-285), appropriately scored at 5.3 (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with only VC:L and no integrity or availability impact). All signals point to low real-world priority rather than an urgent threat. The CVSS vector confirms network-reachable, low-complexity exploitation but requires an authenticated low-privilege account (PR:L), so this is not an unauthenticated breach. EPSS is low at 0.21% (10th percentile), the vulnerability is NOT in CISA KEV, and no public exploit has been identified - three independent signals that converge on low exploitation likelihood. The impact is explicitly limited by the vendor to disclosure of 'a small amount of sensitive information' (e.g., viewing other team overviews), consistent with the single VC:L confidentiality metric. No signals conflict here; the low EPSS, absence of KEV, and limited technical impact all agree this is a minor information-disclosure issue, not a high-risk flaw. Note the input Tag labels this 'Authentication Bypass,' but the description and CWE-285 describe an authorization (access-control) failure by an already-authenticated user, not an authentication bypass - defenders should treat it as broken access control.

A user with a legitimate low-privilege Jira Align account browses to or directly requests application endpoints they should not be authorized to see, and the application fails to enforce object/function-level access control. The attacker thereby views limited data belonging to other teams (such as other teams' overviews) without needing to escalate privileges or bypass login. No public exploit code is known, and exploitation yields only limited information disclosure.