BaseFortify

Publication date: 2025-10-22

Last updated on: 2025-10-24

Assigner: Atlassian

Description

Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view portfolio rooms without the required permission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-22

Last Modified

2025-10-24

Generated

2026-07-06

AI Q&A

2025-10-22

EPSS Evaluated

2026-07-05

NVD

CVE-2025-22174

Affected Vendors & Products

Vendor	Product	Version / Range
atlassian	jira_align	From 11.14.0 (inc) to 11.16.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Jira Align is an authorization issue where a low-privilege user can access endpoints they should not be able to. This unauthorized access allows them to view sensitive information, such as portfolio rooms, without having the required permissions.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive information to users who should not have access. This could result in exposure of confidential data, potentially harming business operations or competitive advantage.

Hi! I’m here to help you understand CVE-2025-22174. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70