CVE-2025-22175

Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user's private checklist.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://jira.atlassian.com/browse/JIRAALIGN-8644	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:atlassian:jira_align:*:*:*:*:*:*:*:*

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Jira Align es vulnerable a un problema de autorización. Un usuario con pocos privilegios puede acceder a puntos finales inesperados que divulgan una pequeña cantidad de información sensible. Por ejemplo, un usuario de bajo nivel pudo modificar los pasos de la lista de verificación privada de otro usuario.

Information

Published : 2025-10-22 17:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-22175

Mitre link : CVE-2025-22175

CVE.ORG link : CVE-2025-22175

JSON object : View

Products Affected

atlassian

jira_align

CWE

NVD-CWE-noinfo CWE-285

Improper Authorization

{"id": "CVE-2025-22175", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-22175", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T18:08:17.435004Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@atlassian.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@atlassian.com", "affectedData": [{"vendor": "Atlassian", "product": "Jira Align", "versions": [{"status": "unaffected", "version": "< 11.14.0"}, {"status": "affected", "version": ">= 11.14.0"}, {"status": "affected", "version": ">= 11.14.1"}, {"status": "affected", "version": ">= 11.15.0"}, {"status": "affected", "version": ">= 11.15.1"}, {"status": "affected", "version": ">= 11.16.0"}, {"status": "unaffected", "version": ">= 11.16.1"}]}]}], "published": "2025-10-22T17:15:57.940", "references": [{"url": "https://jira.atlassian.com/browse/JIRAALIGN-8644", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@atlassian.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user's private checklist."}, {"lang": "es", "value": "Jira Align es vulnerable a un problema de autorizaci\u00f3n. Un usuario con pocos privilegios puede acceder a puntos finales inesperados que divulgan una peque\u00f1a cantidad de informaci\u00f3n sensible. Por ejemplo, un usuario de bajo nivel pudo modificar los pasos de la lista de verificaci\u00f3n privada de otro usuario."}], "lastModified": "2026-10-08T11:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:jira_align:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE85D038-4C13-4104-B53E-F3022F5D8117", "versionEndExcluding": "11.16.1", "versionStartIncluding": "11.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}