CVE-2025-22171
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users.
Risk Assessment
A low-privileged user can compromise the privacy and integrity of other users' data, potentially leading to unauthorized changes and information leaks.
Recommendation
It is recommended to review permission settings in Jira Align and apply vendor-provided patches, as well as restrict access to checklist functionality.
Other vulnerabilities in Jira Align
See all- CVE-2025-22178Medium
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view items on the 'Why' page.
- CVE-2025-22177Medium
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews.
- CVE-2025-22176Medium
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view audit log items.
- CVE-2025-22175Medium
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user's private checklist.
- CVE-2025-22174Medium
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view portfolio rooms without the required permission.
- CVE-2025-22173Medium
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view certain sprint data without the required permission.
- CVE-2025-22172Medium
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read external reports without the required permission.
- CVE-2025-22170Medium
Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action.
- CVE-2025-22169Medium
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to subscribe to an item/object without having the expected permission level.
- CVE-2025-22168Medium
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read the steps of another user's private checklist.
Original NVD description (English source)
Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS