Atlassian Jira Align Improper Authorization Vulnerability Allowing Unauthorized Access to Sensitive Information

A vulnerability in Jira Align related to improper authorization has been identified. This issue allows low-privilege users to access certain endpoints that reveal a limited amount of sensitive information. For instance, a user with minimal permissions was able to subscribe to an item or object without the necessary authorization level. The vulnerability affects Jira Align versions 11.14.0, 11.14.1, 11.15.0, 11.15.1, and 11.16.0.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information and allow low-privilege users to perform actions reserved for higher-privilege users, such as subscribing to certain items or objects.

Remediation

Users can upgrade to Jira Align version 11.16.1 to address this vulnerability.