Jira Align
Monthly
Improper authorization in Atlassian Jira Align allows a remote authenticated low-privilege user to access endpoints outside their intended role and read a limited amount of sensitive information, such as entries on the 'Why' page. Exploitation requires a valid low-privilege account (CVSS 4.0 PR:L), with no user interaction, and results only in low confidentiality impact; no public exploit code has been identified at time of analysis, and EPSS is 0.21% (10th percentile). This is a genuine but low-to-moderate priority authorization flaw, not an unauthenticated bypass and not confirmed in CISA KEV from the supplied data.
Authorization bypass in Atlassian Jira Align allows any authenticated low-privilege user to reach endpoints that should be restricted to higher-privileged roles, disclosing a small amount of sensitive information such as other teams' overview pages. The flaw is confirmed by CVSS 4.0 vector PR:L - it is not exploitable anonymously; an attacker must already hold a valid low-privilege Jira Align account, making insider or compromised-credential scenarios the realistic threat model, with no integrity or availability impact. Severity is low (5.3), no public exploit code or confirmed active exploitation has been identified, and EPSS is negligible at 0.21% (10th percentile).
Authenticated low-privilege users of Atlassian Jira Align can access restricted endpoints and disclose limited sensitive information, including audit log items, due to an improper authorization flaw (CWE-285). The flaw requires a valid low-privilege account (PR:L) and network access, with no user interaction or special configuration; it is not a pre-authentication bypass despite the 'Authentication Bypass' tag. No public exploit identified at time of analysis, EPSS is 0.21% (10th percentile), and the independent assessment rates this as a low-to-moderate priority issue with only limited confidentiality impact.
Jira Align's broken object-level authorization permits an authenticated low-privilege user to access or modify limited resources belonging to other users, such as another user's private checklist steps. The issue is rated CVSS 5.3 (CWE-285); the provided EPSS is 0.18% (6th percentile), and no public exploit identified at time of analysis. All Jira Align versions are presumed affected per the CPE entry, and exploitation requires a valid low-privilege account on the target instance.
Improper authorization in Atlassian Jira Align lets a low-privilege authenticated user reach endpoints that should be gated behind higher permissions, exposing a small amount of sensitive information - the vendor cites a low-level user viewing portfolio rooms without the required permission as a concrete case. According to the CVSS vector (PR:L), exploitation requires a valid low-privilege Jira Align account; the issue is not reachable by fully unauthenticated attackers, requires no user interaction or non-default configuration, and is limited to low confidentiality impact with no integrity or availability effect. There is no public exploit code identified and no CISA KEV listing, and the EPSS score of 0.21% (10th percentile) indicates a very low likelihood of exploitation attempts, consistent with an insider- or compromised-account-driven risk rather than an opportunistic remote attack.
Improper authorization in Atlassian Jira Align lets an authenticated low-privilege user reach endpoints that fail to enforce the required permission checks, exposing a small amount of sensitive data such as sprint information. The flaw is rated CVSS 4.0 base 5.3 (assessed CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting limited confidentiality-only impact with no modification or disruption. Exploitation requires a valid low-privilege Jira Align account and knowledge of the affected endpoint paths; no public exploit identified at time of analysis and EPSS is low (0.21%, 10th percentile), with the issue not appearing in CISA KEV.
Authenticated low-privilege users of Atlassian Jira Align can reach application endpoints they are not authorized to use and read data such as external reports without holding the required permission, producing a limited disclosure of sensitive information. Exploitation requires an existing valid low-privilege account (PR:L) with network access, grants no privilege escalation or data modification, and is confined to low confidentiality impact, so this is a genuine-but-low-priority authorization flaw rather than a high-severity compromise. EPSS is 0.21% (10th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry.
Improper authorization in Atlassian Jira Align's checklist feature lets any authenticated user with low privileges modify the private checklists belonging to other users. Exploitation requires a valid Jira Align account on the same tenant (PR:L in the assessed vector) and needs no victim interaction, but it is confined to unauthorized data modification - there is no confidentiality or availability impact, placing it firmly in the low-risk tier. The vendor's advisory is published under JIRAALIGN-8640, EPSS sits at just 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Improper authorization in Atlassian Jira Align allows an authenticated low-privilege user to perform actions they are not entitled to by supplying a state-related parameter that belongs to a user who does hold the required privileges, effectively bypassing the per-user permission check (CWE-285). The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N confirms the attacker must hold a valid low-privilege account (PR:L, so not unauthenticated access), needs no victim interaction, and can achieve only a low-integrity impact with no confidentiality or availability loss. Risk is moderate rather than urgent: EPSS is 0.21% (10th percentile), there is no CISA KEV entry, no POC is referenced, and exploitation requires an already-provisioned account on the instance.
Missing per-endpoint authorization checks in Atlassian Jira Align allow any authenticated low-privilege user to reach endpoints and perform actions - such as subscribing to an item or object - that are reserved for higher-privilege roles, disclosing a small amount of sensitive information. Exploitation requires a valid low-privilege Jira Align account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), produces no integrity or availability impact, and no public exploit code has been identified at time of analysis. With an EPSS score of 0.18% (6th percentile), this is a genuinely low-priority, low-real-risk issue despite being a valid flaw.
Improper authorization checks in Atlassian Jira Align allow an authenticated low-privilege user to reach endpoints beyond their intended permissions, disclosing small amounts of other users' sensitive data - for example, reading the steps of another user's private checklist. Exploitation requires a valid tenant account (PR:L per the CVSS vector), is remote and low-complexity with no user interaction, and results in only limited confidentiality impact with no integrity, availability, or scope change. Risk is further tempered by a very low EPSS of 0.21% (9th percentile) and no public exploit code or CISA KEV listing identified at time of analysis.
The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper authorization in Atlassian Jira Align allows a remote authenticated low-privilege user to access endpoints outside their intended role and read a limited amount of sensitive information, such as entries on the 'Why' page. Exploitation requires a valid low-privilege account (CVSS 4.0 PR:L), with no user interaction, and results only in low confidentiality impact; no public exploit code has been identified at time of analysis, and EPSS is 0.21% (10th percentile). This is a genuine but low-to-moderate priority authorization flaw, not an unauthenticated bypass and not confirmed in CISA KEV from the supplied data.
Authorization bypass in Atlassian Jira Align allows any authenticated low-privilege user to reach endpoints that should be restricted to higher-privileged roles, disclosing a small amount of sensitive information such as other teams' overview pages. The flaw is confirmed by CVSS 4.0 vector PR:L - it is not exploitable anonymously; an attacker must already hold a valid low-privilege Jira Align account, making insider or compromised-credential scenarios the realistic threat model, with no integrity or availability impact. Severity is low (5.3), no public exploit code or confirmed active exploitation has been identified, and EPSS is negligible at 0.21% (10th percentile).
Authenticated low-privilege users of Atlassian Jira Align can access restricted endpoints and disclose limited sensitive information, including audit log items, due to an improper authorization flaw (CWE-285). The flaw requires a valid low-privilege account (PR:L) and network access, with no user interaction or special configuration; it is not a pre-authentication bypass despite the 'Authentication Bypass' tag. No public exploit identified at time of analysis, EPSS is 0.21% (10th percentile), and the independent assessment rates this as a low-to-moderate priority issue with only limited confidentiality impact.
Jira Align's broken object-level authorization permits an authenticated low-privilege user to access or modify limited resources belonging to other users, such as another user's private checklist steps. The issue is rated CVSS 5.3 (CWE-285); the provided EPSS is 0.18% (6th percentile), and no public exploit identified at time of analysis. All Jira Align versions are presumed affected per the CPE entry, and exploitation requires a valid low-privilege account on the target instance.
Improper authorization in Atlassian Jira Align lets a low-privilege authenticated user reach endpoints that should be gated behind higher permissions, exposing a small amount of sensitive information - the vendor cites a low-level user viewing portfolio rooms without the required permission as a concrete case. According to the CVSS vector (PR:L), exploitation requires a valid low-privilege Jira Align account; the issue is not reachable by fully unauthenticated attackers, requires no user interaction or non-default configuration, and is limited to low confidentiality impact with no integrity or availability effect. There is no public exploit code identified and no CISA KEV listing, and the EPSS score of 0.21% (10th percentile) indicates a very low likelihood of exploitation attempts, consistent with an insider- or compromised-account-driven risk rather than an opportunistic remote attack.
Improper authorization in Atlassian Jira Align lets an authenticated low-privilege user reach endpoints that fail to enforce the required permission checks, exposing a small amount of sensitive data such as sprint information. The flaw is rated CVSS 4.0 base 5.3 (assessed CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting limited confidentiality-only impact with no modification or disruption. Exploitation requires a valid low-privilege Jira Align account and knowledge of the affected endpoint paths; no public exploit identified at time of analysis and EPSS is low (0.21%, 10th percentile), with the issue not appearing in CISA KEV.
Authenticated low-privilege users of Atlassian Jira Align can reach application endpoints they are not authorized to use and read data such as external reports without holding the required permission, producing a limited disclosure of sensitive information. Exploitation requires an existing valid low-privilege account (PR:L) with network access, grants no privilege escalation or data modification, and is confined to low confidentiality impact, so this is a genuine-but-low-priority authorization flaw rather than a high-severity compromise. EPSS is 0.21% (10th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry.
Improper authorization in Atlassian Jira Align's checklist feature lets any authenticated user with low privileges modify the private checklists belonging to other users. Exploitation requires a valid Jira Align account on the same tenant (PR:L in the assessed vector) and needs no victim interaction, but it is confined to unauthorized data modification - there is no confidentiality or availability impact, placing it firmly in the low-risk tier. The vendor's advisory is published under JIRAALIGN-8640, EPSS sits at just 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Improper authorization in Atlassian Jira Align allows an authenticated low-privilege user to perform actions they are not entitled to by supplying a state-related parameter that belongs to a user who does hold the required privileges, effectively bypassing the per-user permission check (CWE-285). The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N confirms the attacker must hold a valid low-privilege account (PR:L, so not unauthenticated access), needs no victim interaction, and can achieve only a low-integrity impact with no confidentiality or availability loss. Risk is moderate rather than urgent: EPSS is 0.21% (10th percentile), there is no CISA KEV entry, no POC is referenced, and exploitation requires an already-provisioned account on the instance.
Missing per-endpoint authorization checks in Atlassian Jira Align allow any authenticated low-privilege user to reach endpoints and perform actions - such as subscribing to an item or object - that are reserved for higher-privilege roles, disclosing a small amount of sensitive information. Exploitation requires a valid low-privilege Jira Align account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), produces no integrity or availability impact, and no public exploit code has been identified at time of analysis. With an EPSS score of 0.18% (6th percentile), this is a genuinely low-priority, low-real-risk issue despite being a valid flaw.
Improper authorization checks in Atlassian Jira Align allow an authenticated low-privilege user to reach endpoints beyond their intended permissions, disclosing small amounts of other users' sensitive data - for example, reading the steps of another user's private checklist. Exploitation requires a valid tenant account (PR:L per the CVSS vector), is remote and low-complexity with no user interaction, and results in only limited confidentiality impact with no integrity, availability, or scope change. Risk is further tempered by a very low EPSS of 0.21% (9th percentile) and no public exploit code or CISA KEV listing identified at time of analysis.
The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.