CVE-2022-36803 Privilege escalation in Jira Align

What is CVE-2022-36803?

CVE-2022-36803 is a high-severity vulnerability in Atlassian Jira Align, published on 14 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role to Super Admin. This vulnerability was reported by Jacob Shafer from Bishop Fox.

Weakness: CWE-276

Which versions are affected by CVE-2022-36803?

It affects 1 product.

Products include Atlassian Jira Align.

How do I fix CVE-2022-36803?

No fix has been published for CVE-2022-36803 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-36803 being exploited?

There is no known exploitation of CVE-2022-36803 in the wild and no public exploit code.

Other vulnerabilities in Atlassian Jira Align

• CVE-2025-22168 Missing authorization in Jira Align Medium 5.3
• CVE-2025-22169 Missing authorization in Jira Align Medium 5.3
• CVE-2025-22170 Missing authorization in Jira Align Medium 5.3
• CVE-2025-22171 Missing authorization in Jira Align Medium 5.3
• CVE-2025-22172 Missing authorization in Jira Align Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7hpj-mxfh-5j9j.