CVE-2022-36803

8.8 highEPSS 0.7%

High (8.8) in atlassian jira align. EPSS 0.7% chance of exploitation in the next 30 days.

The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role to Super Admin. This vulnerability was reported by Jacob Shafer from Bishop Fox.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE: CWE-276
Published: 2022-10-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:jira_align

References

https://jira.atlassian.com/browse/JIRAALIGN-4281
https://jira.atlassian.com/browse/JIRAALIGN-4281

Check your stack JSON