CVE-2025-22168

Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read the steps of another user's private checklist.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://jira.atlassian.com/browse/JIRAALIGN-8637	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:atlassian:jira_align:*:*:*:*:*:*:*:*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Jira Align es vulnerable a un problema de autorización. Un usuario con privilegios bajos puede acceder a puntos finales inesperados que divulgan una pequeña cantidad de información sensible. Por ejemplo, un usuario de bajo nivel pudo leer los pasos de la lista de verificación privada de otro usuario.

Information

Published : 2025-10-22 17:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-22168

Mitre link : CVE-2025-22168

CVE.ORG link : CVE-2025-22168

JSON object : View

Products Affected

atlassian

jira_align

CWE

NVD-CWE-noinfo CWE-285

Improper Authorization

{"id": "CVE-2025-22168", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-22168", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-24T14:45:17.604258Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@atlassian.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@atlassian.com", "affectedData": [{"vendor": "Atlassian", "product": "Jira Align", "versions": [{"status": "unaffected", "version": "< 11.14.0"}, {"status": "affected", "version": ">= 11.14.0"}, {"status": "affected", "version": ">= 11.14.1"}, {"status": "affected", "version": ">= 11.15.0"}, {"status": "affected", "version": ">= 11.15.1"}, {"status": "affected", "version": ">= 11.16.0"}, {"status": "unaffected", "version": ">= 11.16.1"}]}]}], "published": "2025-10-22T17:15:57.090", "references": [{"url": "https://jira.atlassian.com/browse/JIRAALIGN-8637", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@atlassian.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read the steps of another user's private checklist."}, {"lang": "es", "value": "Jira Align es vulnerable a un problema de autorizaci\u00f3n. Un usuario con privilegios bajos puede acceder a puntos finales inesperados que divulgan una peque\u00f1a cantidad de informaci\u00f3n sensible. Por ejemplo, un usuario de bajo nivel pudo leer los pasos de la lista de verificaci\u00f3n privada de otro usuario."}], "lastModified": "2026-10-08T11:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:jira_align:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE85D038-4C13-4104-B53E-F3022F5D8117", "versionEndExcluding": "11.16.1", "versionStartIncluding": "11.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}