Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2025-22170: Jira Align: Unauthorized users can take actions they shouldn't
CVE-2025-22170 · published 1 year ago
Summary
An issue in Jira Align affects how permissions are checked. This means a user without the right permissions might be able to perform an action they shouldn't be able to do. You should review Jira Align permissions and settings to ensure they match your team's access requirements.
What to do
- Update atlassian jira_align to version 11.16.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| atlassian | jira_align |
>= 11.14.0, < 11.16.1 cpe:2.3:a:atlassian:jira_align:*:*:*:*:*:*:*:* |
Original advisory text
Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user wit...
Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action.
References
- https://jira.atlassian.com/browse/JIRAALIGN-8639 Issue Tracking Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-285Improper Authorization
Timeline
Published22 Oct 2025
Updated29 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta