BaseFortify

Publication date: 2025-10-22

Last updated on: 2025-10-24

Assigner: Atlassian

Description

Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to subscribe to an item/object without having the expected permission level.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-22

Last Modified

2025-10-24

Generated

2026-07-06

AI Q&A

2025-10-22

EPSS Evaluated

2026-07-05

NVD

CVE-2025-22169

Affected Vendors & Products

Vendor	Product	Version / Range
atlassian	jira_align	From 11.14.0 (inc) to 11.16.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Jira Align is an authorization issue where a low-privilege user can access endpoints they should not be able to. This allows them to perform actions like subscribing to items or objects without having the required permission level, potentially exposing some sensitive information.

Impact Analysis

The impact of this vulnerability is that unauthorized users with low privileges can access certain endpoints and gain access to sensitive information or perform actions they are not permitted to. This could lead to information disclosure and unauthorized changes within Jira Align.

Hi! I’m here to help you understand CVE-2025-22169. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70