Atlassian Jira Align CVE-2025-22178

Requires a valid authenticated Jira Align account at a low privilege level (PR:L) with network access to the application; no user interaction and no non-default configuration are needed. Exploitation is limited to unauthorized read access of a small amount of sensitive information via endpoints not intended for the user's role (e.g., the 'Why' page). Limiting factors: the attacker must already possess credentials/provisioned access, impact is read-only disclosure with no integrity or availability effect, and only a limited quantity of data is exposed per the vendor description.

This is a genuine but low-to-moderate priority issue, best characterized as a high-visibility-but-low-real-impact authorization flaw rather than a severe threat. The signals are internally consistent and all point low: the CVSS 4.0 base of 5.3 (Medium) is driven by network reach (AV:N) and low complexity (AC:L) but is capped by a required low-privilege account (PR:L) and only a Low confidentiality impact (VC:L), with no integrity or availability impact (VI:N/VA:N) and no scope change (SC:N/SI:N/SA:N). EPSS reinforces this: 0.21% probability at the 10th percentile indicates very low likelihood of near-term broad exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation. No SSVC decision data was provided. The one area to verify is the tag 'Authentication Bypass,' which conflicts with the description and CWE-862 (Missing Authorization): this is a broken-access-control issue affecting an already-authenticated low-privilege user, not an authentication bypass - treat it as horizontal/vertical privilege/data exposure, not pre-auth compromise.

An authenticated low-privilege Jira Align user (for example, a team member or guest-tier account) directly requests endpoints their role should not reach, such as the 'Why' page, and receives a small amount of sensitive organizational information not intended for their role. No public exploit code is identified, so exploitation would rely on manual endpoint enumeration by an already-provisioned user. The low attack complexity (AC:L) means no special timing or conditions are needed once a valid account exists.