CVE-2025-22173: Jira Align Information Disclosure Flaw

CVE-2025-22173 Overview

CVE-2025-22173 is an authorization vulnerability in Atlassian Jira Align. A low-privilege authenticated user can access endpoints that should be restricted, disclosing a limited amount of sensitive information. Atlassian's advisory describes a scenario where a low-level user viewed sprint data without holding the required permission.

The issue maps to [CWE-285] Improper Authorization. It requires network access and valid low-privilege credentials, with no user interaction. Impact is limited to confidentiality of a small subset of data. There is no reported impact to integrity or availability of the Jira Align tenant.

Critical Impact
Authenticated low-privilege users can read sprint data and other restricted endpoint responses without the required role, leading to unauthorized information disclosure inside Jira Align tenants.

Affected Products

Atlassian Jira Align (see vendor advisory for fixed build)
Deployments exposing Jira Align endpoints to authenticated low-privilege users
Multi-team tenants relying on role-based sprint data restrictions

Discovery Timeline

2025-10-22 - CVE-2025-22173 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22173

Vulnerability Analysis

Jira Align enforces role-based access to program and portfolio data, including sprint details tied to specific teams. The vulnerability stems from missing or incorrect authorization checks on certain endpoints. An authenticated user with a low-privilege role can call these endpoints directly and receive data that their role should not expose.

Atlassian classifies the disclosed data as a small amount of sensitive information. The example cited in the advisory is sprint data visible without the required permission. Because access requires valid authentication, exploitation is limited to users who already possess a Jira Align account in the tenant.

The defect is a broken access control issue rather than a code execution or injection flaw. It does not permit modification of records or disruption of service. It does allow a low-privilege insider or a compromised low-privilege account to enumerate restricted operational data.

Root Cause

The root cause is improper authorization ([CWE-285]) at the endpoint layer. Server-side handlers verify that a session is authenticated but do not consistently enforce the role or permission required for the requested resource. Authorization is treated as a coarse check instead of a per-resource decision.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker with any valid Jira Align account issues HTTP requests to affected endpoints. The server returns sprint or related data even though the caller lacks the required role. No user interaction, phishing, or client-side component is required.

See Atlassian's ticket JIRAALIGN-8642 for the vendor's technical description and fix details.

Detection Methods for CVE-2025-22173

Indicators of Compromise

Requests from low-privilege user sessions to sprint, program, or team endpoints they do not normally access.
Elevated volumes of successful HTTP 200 responses to endpoints outside a user's assigned team or program scope.
Sequential enumeration patterns against /api/ resources by a single account within a short time window.

Detection Strategies

Baseline each Jira Align user's typical endpoint access by role, then alert on deviations that return data from restricted scopes.
Correlate authentication logs with API access logs to surface low-privilege accounts pulling program or sprint objects tied to other teams.
Review audit logs for accounts whose read volume against sprint or portfolio endpoints spikes without a corresponding assignment change.

Monitoring Recommendations

Ingest Jira Align application and access logs into a centralized SIEM or data lake with per-user, per-endpoint fields.
Alert on any read of sprint data by an account lacking the corresponding team or program membership in the identity system.
Track failed and successful requests to endpoints referenced in Atlassian ticket JIRAALIGN-8642 after patch deployment.

How to Mitigate CVE-2025-22173

Immediate Actions Required

Upgrade Jira Align to the fixed release identified in Atlassian ticket JIRAALIGN-8642.
Audit current Jira Align user roles and remove standing low-privilege accounts that are inactive or unnecessary.
Rotate API tokens and session credentials for accounts that accessed sensitive endpoints during the exposure window.

Patch Information

Atlassian tracks the fix under JIRAALIGN-8642. Cloud-hosted Jira Align tenants receive the update from Atlassian directly. Administrators should confirm the tenant build matches the fixed version referenced in the advisory and validate that the previously affected endpoints now enforce role checks.

Workarounds

Restrict network access to Jira Align through allow-lists or single sign-on gateways until the patch is applied.
Reduce the number of low-privilege accounts and disable self-service account provisioning where possible.
Monitor and rate-limit API traffic per user to slow enumeration attempts against affected endpoints.

bash

# Example: query recent low-privilege access to sprint endpoints from access logs
grep -E "GET /api/.*(sprint|program|team)" jira-align-access.log \
  | awk '{print $1, $3, $7, $9}' \
  | sort | uniq -c | sort -nr | head -50