CVE-2025-22170: Atlassian Jira Align Auth Bypass Vulnerability

CVE-2025-22170 Overview

Atlassian Jira Align contains a broken access control vulnerability that allows low-privilege authenticated users to perform actions restricted to higher-privileged accounts. The flaw stems from improper server-side authorization checks when specific state-related parameters are supplied in requests. An attacker with valid low-privilege credentials can manipulate these parameters to invoke functionality reserved for privileged users. The issue is tracked by Atlassian under JIRAALIGN-8639 and mapped to [CWE-285] Improper Authorization.

Critical Impact

Authenticated low-privilege users can bypass authorization controls in Jira Align to execute actions restricted to higher-privileged roles, resulting in limited integrity impact to enterprise agile planning data.

Affected Products

• Atlassian Jira Align (cloud and self-managed instances tracked in JIRAALIGN-8639)
• All versions prior to the Atlassian-issued fix documented in the vendor advisory
• Deployments where low-privilege user accounts are provisioned alongside privileged workflow roles

Discovery Timeline

• 2025-10-22 - CVE-2025-22170 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22170

Vulnerability Analysis

The vulnerability is an authorization bypass in Jira Align, Atlassian's enterprise agile planning platform. Jira Align enforces role-based access to program, portfolio, and workflow actions. This flaw allows a low-privilege authenticated user to invoke actions restricted to privileged roles by supplying a state-related request parameter tied to a privileged user. The server accepts the parameter as authoritative rather than re-validating the caller's effective permissions.

The issue is classified under [CWE-285] Improper Authorization. The attack requires valid authentication and network access to the Jira Align tenant. Impact is limited to integrity of application data; confidentiality and availability are not directly affected according to the vendor-scored vector. EPSS currently reflects a low probability of exploitation activity in the near term.

Root Cause

The root cause is a missing or insufficient server-side authorization check on a state-carrying request parameter. The application trusts client-supplied state indicating that a privileged user is associated with the action, instead of re-evaluating the authenticated principal's role and scope. This is a classic broken access control pattern where authorization decisions rely on request-supplied context.

Attack Vector

Exploitation occurs over the network against an authenticated Jira Align session. A low-privilege user submits a crafted request to a protected endpoint and includes the state-related parameter referencing a privileged user with rights to perform the action. The backend processes the request under the supplied context and completes the privileged operation. No user interaction from the privileged account is required.

No public proof-of-concept or exploit code has been published. Refer to the Atlassian JIRAALIGN-8639 advisory for vendor-authoritative technical detail.

Detection Methods for CVE-2025-22170

Indicators of Compromise

• Successful privileged actions in Jira Align audit logs attributed to accounts that do not hold the required role at the time of the action.
• Requests to state-changing endpoints that include user or state identifiers referencing accounts other than the authenticated session principal.
• Unexpected changes to workflow states, program configurations, or approval records without a corresponding privileged session.

Detection Strategies

• Correlate application audit events with the authenticated user's role assignments at the time of the request and alert on mismatches.
• Baseline normal parameter usage on Jira Align state-transition endpoints and flag requests that supply user-identity parameters inconsistent with the session.
• Review Atlassian access logs for the endpoints referenced in JIRAALIGN-8639 once identified by the vendor.

Monitoring Recommendations

• Forward Jira Align and identity provider logs to a centralized analytics platform and retain them for post-incident review.
• Alert on privilege-sensitive actions such as workflow overrides, role changes, and program configuration edits performed by low-privilege accounts.
• Track failed and successful authorization checks separately to surface anomalous success patterns from low-privilege sessions.

How to Mitigate CVE-2025-22170

Immediate Actions Required

• Apply the fix referenced in the Atlassian advisory JIRAALIGN-8639 as soon as it is available for your tenant or deployment.
• Audit Jira Align user roles and remove standing privileges from accounts that do not require them.
• Review recent audit logs for privileged actions performed by low-privilege accounts and validate them with business owners.

Patch Information

Atlassian tracks the remediation under issue JIRAALIGN-8639. Cloud tenants receive the fix through Atlassian's managed update cycle. Administrators of self-managed environments should consult the vendor advisory for the specific fixed version and upgrade guidance. Confirm the deployed build number against the vendor-published fixed version after the update.

Workarounds

• Restrict access to the Jira Align tenant to trusted networks or VPN-only sessions until the patch is applied.
• Reduce the population of low-privilege accounts with active sessions where feasible, and enforce short session lifetimes.
• Increase monitoring on privileged workflow actions and require out-of-band confirmation for high-impact changes during the exposure window.

# Example: export Jira Align audit events for review of privileged actions
# Replace <tenant> and <token> with your Atlassian tenant and API token
curl -s -H "Authorization: Bearer <token>" \
  "https://<tenant>.jiraalign.com/api/audit/events?since=2025-10-01" \
  | jq '.[] | select(.action | test("role|workflow|approval"))'