CVE-2025-22174: Jira Align Information Disclosure Vulnerability

CVE-2025-22174 Overview

CVE-2025-22174 is an authorization flaw in Atlassian Jira Align. A low-privilege authenticated user can access endpoints that disclose sensitive information intended for higher-privileged roles. Atlassian confirmed that a low-level user could view portfolio rooms without holding the required permission.

The weakness falls under [CWE-285] Improper Authorization. Exploitation requires valid credentials but no user interaction. The impact is limited to disclosure of a small amount of sensitive data, with no documented impact on integrity or availability.

Critical Impact
Authenticated low-privilege users can enumerate restricted Jira Align endpoints such as portfolio rooms and read data they are not authorized to view.

Affected Products

Atlassian Jira Align (cloud instances tracked under JIRAALIGN-8643)
Deployments exposing portfolio room endpoints to standard end users
Tenants with low-privilege roles granted baseline access to the application

Discovery Timeline

2025-10-22 - CVE-2025-22174 published to the National Vulnerability Database
2026-10-08 - Last updated in the NVD database

Technical Details for CVE-2025-22174

Vulnerability Analysis

Jira Align fails to enforce role-based authorization checks on specific application endpoints. A user authenticated with a low-privilege role can issue requests to endpoints reserved for higher-privileged users and receive restricted data in the response. Atlassian's advisory specifically cites the ability to view portfolio rooms without the required permission.

The issue is a server-side access control gap rather than a client-side rendering problem. Hiding navigation elements in the UI does not prevent direct requests to the underlying API routes. Because the application accepts and processes these requests, the authorization boundary between user tiers is broken.

The disclosed information is described as a small amount of sensitive data. In enterprise portfolio management, exposed metadata can include program names, team structures, roadmap items, or strategic initiatives tracked within portfolio rooms.

Root Cause

The root cause is missing or insufficient authorization validation on affected endpoints. The application authenticates the session but does not consistently verify that the caller's role carries the entitlement required for the requested resource. This matches the [CWE-285] Improper Authorization pattern.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker with any valid Jira Align account enumerates endpoints associated with higher-privileged features, such as portfolio room views, and issues direct HTTP requests. The server returns protected data because the role check is absent or incorrectly implemented. No public proof-of-concept, exploit code, or CISA KEV listing exists for this CVE at the time of writing.

See the Atlassian JIRAALIGN-8643 bug report for vendor-supplied technical context.

Detection Methods for CVE-2025-22174

Indicators of Compromise

Successful HTTP 200 responses to portfolio room or administrative endpoints originating from accounts assigned only base-level Jira Align roles.
Access patterns where a single low-privilege account requests a wide range of API routes in short succession, indicating endpoint enumeration.
Audit log entries showing read access to portfolio or program data by users outside the expected business unit or role mapping.

Detection Strategies

Baseline normal endpoint usage per Jira Align role, then alert on deviations where low-privilege users reach restricted paths.
Correlate authentication events with resource access to identify sessions that read data inconsistent with their assigned permissions.
Review Jira Align audit logs for repeated access attempts to the same high-value resources from the same low-privilege identity.

Monitoring Recommendations

Forward Jira Align access logs to a centralized analytics platform and retain them long enough to investigate retroactive misuse.
Alert on first-time access by a user to portfolio room endpoints or any resource that is normally gated behind elevated roles.
Track response payload sizes for low-privilege sessions to detect unusually large or sensitive data returns.

How to Mitigate CVE-2025-22174

Immediate Actions Required

Apply the fix delivered by Atlassian for Jira Align as tracked in JIRAALIGN-8643.
Audit role assignments and remove unnecessary low-privilege accounts that no longer require Jira Align access.
Review audit logs since the vulnerability was published on 2025-10-22 for signs of unauthorized data access by low-privilege users.

Patch Information

Atlassian delivers Jira Align updates through its cloud service lifecycle. Customers should confirm that their tenant is running the version referenced in the Atlassian JIRAALIGN-8643 bug report and coordinate with Atlassian support if validation is required.

Workarounds

Restrict Jira Align access to users with a demonstrated business need until the fix is confirmed in the tenant.
Enforce network-layer controls, such as SSO conditional access or IP allowlisting, to reduce the pool of accounts that can reach the application.
Rotate credentials and reset active sessions for any account suspected of exercising the vulnerable endpoints.

bash

# Configuration example
# Review Jira Align user roles via the admin console and export the role matrix
# for comparison against portfolio room access logs.
# Example audit query (pseudocode) run against exported access logs:
grep -Ei "portfolio|room|admin" jira_align_access.log \
  | awk '$status==200 {print $user, $role, $endpoint}' \
  | sort -u