CVE-2025-22172: Jira Align Information Disclosure Flaw

CVE-2025-22172 is an authorization flaw in Atlassian Jira Align allowing low-privilege users to access restricted endpoints and view sensitive information like external reports without proper permissions. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-22172 Overview

CVE-2025-22172 is a broken authorization vulnerability [CWE-285] in Atlassian Jira Align. A low-privilege authenticated user can access endpoints that should be restricted, disclosing a limited amount of sensitive information. Atlassian's advisory cites the ability for a low-level user to read external reports without holding the required permission.

The issue is exploitable over the network with low privileges and no user interaction. Atlassian tracks the fix in the internal ticket JIRAALIGN-8641.

Critical Impact
An authenticated low-privilege account can read data exposed by unintended endpoints, such as external reports, bypassing Jira Align's role-based permission model.

Affected Products

Atlassian Jira Align (see vendor advisory for fixed build)
Deployments granting broad low-privilege user access
Instances exposing the reporting subsystem to standard users

Discovery Timeline

2025-10-22 - CVE-2025-22172 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22172

Vulnerability Analysis

The flaw is a missing authorization check on one or more Jira Align endpoints. The application authenticates the requester but fails to verify whether the user's role grants permission to invoke the endpoint. As a result, low-privilege users reach functionality intended for elevated roles.

Atlassian's advisory specifically references the reading of external reports as an example of unintended access. Because the vulnerability is scoped to a small amount of sensitive information, the confidentiality impact is limited and there is no direct integrity or availability impact.

Root Cause

The root cause is improper authorization [CWE-285]. Access decisions rely on authentication or client-supplied context rather than server-side enforcement of role-based permissions on every protected endpoint. This class of flaw is often described as a broken function-level authorization issue.

Attack Vector

An attacker needs valid credentials for a low-privilege Jira Align account. The attacker sends HTTP requests directly to endpoints that should require higher privileges, such as those backing external reports. The server returns data without enforcing the missing permission check. No user interaction and no additional exploitation primitives are required.

No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2025-22172 at the time of publication. Refer to the Atlassian JIRAALIGN Bug Report for vendor-supplied technical details.

Detection Methods for CVE-2025-22172

Indicators of Compromise

Successful HTTP 200 responses to Jira Align reporting or administrative endpoints from accounts that lack the corresponding role.
Repeated enumeration-style requests to unique endpoint paths from a single low-privilege session.
Access log entries for external report endpoints originating from user roles that do not typically consume them.

Detection Strategies

Correlate Jira Align application logs with the internal role directory to flag requests where the caller's role does not match the endpoint's documented permission requirement.
Baseline normal endpoint usage per role and alert on out-of-profile requests, particularly to /reports or external report APIs.
Review authentication events for accounts making atypically high volumes of distinct endpoint requests in short intervals.

Monitoring Recommendations

Forward Jira Align access and audit logs to a centralized SIEM or data lake for longitudinal analysis.
Track outbound data volume per session to detect scraping of report data by low-privilege accounts.
Alert on newly created low-privilege accounts that immediately query sensitive report endpoints.

How to Mitigate CVE-2025-22172

Immediate Actions Required

Apply the Jira Align update referenced in Atlassian ticket JIRAALIGN-8641 as soon as it is available for your deployment tier.
Audit the Jira Align user directory and disable or reduce accounts that no longer need access.
Review recent access logs for external report endpoints and investigate access by non-privileged roles.

Patch Information

Atlassian tracks the remediation under JIRAALIGN-8641. Cloud-hosted Jira Align tenants receive the fix from Atlassian directly. Administrators of self-managed or dedicated instances should confirm they are running the fixed build referenced in the advisory.

Workarounds

Restrict Jira Align network exposure to trusted corporate networks or VPN segments until patched.
Tighten role assignments so that low-privilege users do not remain provisioned beyond business need.
Monitor and rate-limit requests to report endpoints at the reverse proxy or WAF layer.

bash

# Example WAF rule concept: block low-privilege sessions from report endpoints
# Pseudocode - adapt to your WAF/reverse-proxy syntax
if request.path matches "^/api/.*/reports/external"
   and session.role not in ("Admin", "ReportViewer"):
     deny 403
     log "CVE-2025-22172: blocked unauthorized report access"