CVE-2025-22169: Jira Align Authorization Bypass Vulnerability

CVE-2025-22169 Overview

CVE-2025-22169 is an authorization vulnerability in Atlassian Jira Align that allows low-privilege users to access endpoints beyond their assigned permission level. The flaw enables authenticated attackers to reach functionality and disclose a limited set of sensitive information without holding the required role. Atlassian's advisory cites subscribing to items or objects as one example where permission checks are not properly enforced. The weakness maps to [CWE-285] Improper Authorization and requires network access with low privileges but no user interaction.

Critical Impact
Authenticated low-privilege users can bypass authorization checks in Jira Align to reach endpoints that expose limited sensitive information.

Affected Products

Atlassian Jira Align (see vendor advisory for affected versions)

Discovery Timeline

2025-10-22 - CVE-2025-22169 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22169

Vulnerability Analysis

The vulnerability is a Broken Access Control issue in Jira Align's server-side authorization layer. Endpoints intended for higher-privileged roles do not consistently validate whether the calling user holds the required permission. An authenticated user with the lowest privilege tier can invoke these endpoints directly and receive responses that leak a small amount of sensitive data. Atlassian documents a concrete example: a low-level user can subscribe to an item or object even though subscription actions should be gated by a higher permission level.

The issue is characteristic of missing function-level authorization, where application routing exposes controller actions without enforcing role checks. Because Jira Align aggregates strategic planning data across portfolios, programs, and teams, unauthorized subscription or read access can expose organizational planning context that would otherwise be restricted.

Root Cause

The root cause is missing or incomplete authorization enforcement on specific application endpoints. Authentication is required, but the affected handlers do not verify that the authenticated principal holds the role expected for the requested operation. This is a classic [CWE-285] Improper Authorization pattern.

Attack Vector

Exploitation requires network access to the Jira Align instance and valid low-privilege credentials. The attacker sends direct HTTP requests to endpoints they would not normally reach through the standard UI workflow. No user interaction is required and complexity is low. Public proof-of-concept code is not available and the CVE is not listed in CISA KEV. Technical exploitation details are described in prose only; see the Atlassian JIRAALIGN-8638 advisory for vendor-specific information.

Detection Methods for CVE-2025-22169

Indicators of Compromise

Requests from low-privilege user accounts to Jira Align endpoints associated with subscriptions, notifications, or object management that historically require elevated roles.
Unexpected subscription events or object-watch entries tied to accounts that lack the corresponding role assignment.
HTTP 200 responses to endpoints that should return 401 or 403 for the requesting user's role.

Detection Strategies

Review Jira Align application and audit logs for role-to-endpoint mismatches, focusing on subscribe, follow, and read operations invoked by base-tier users.
Correlate authentication events with sensitive endpoint access to identify accounts issuing requests outside their normal usage pattern.
Baseline expected API paths per user role and alert on deviations, particularly for endpoints not referenced by the standard low-privilege UI.

Monitoring Recommendations

Forward Jira Align access logs to a centralized SIEM or data lake for role-based anomaly analysis.
Track subscription and object-access events per user and flag additions that were not initiated through documented workflows.
Alert on repeated access to non-UI endpoints by the same low-privilege account within short time windows.

How to Mitigate CVE-2025-22169

Immediate Actions Required

Consult the Atlassian JIRAALIGN-8638 advisory to identify fixed Jira Align versions and apply the vendor update.
Audit existing user role assignments and remove accounts that no longer require access.
Review subscription and watcher lists for entries created by users lacking the expected permission level and revoke them.

Patch Information

Atlassian tracks the fix under issue JIRAALIGN-8638. Refer to the Atlassian JIRAALIGN-8638 advisory for the specific Jira Align release that resolves the authorization check and follow standard Jira Align upgrade procedures.

Workarounds

Restrict network access to the Jira Align instance to trusted corporate networks or VPN users while the patch is applied.
Enforce least privilege by reviewing and reducing membership in low-privilege tiers that can authenticate to the application.
Increase logging verbosity on the Jira Align application tier to capture endpoint access for post-incident review.

bash

# Configuration example
# Refer to the vendor advisory for authoritative remediation steps:
# https://jira.atlassian.com/browse/JIRAALIGN-8638