CVE-2025-22177: Atlassian Jira Align Authorization Issue

CVE-2025-22177 Overview

CVE-2025-22177 is a broken authorization vulnerability in Atlassian Jira Align. A low-privilege authenticated user can reach endpoints that should be restricted and view a limited set of sensitive data. The vendor advisory cites an example where a low-level user could view other team overviews. The flaw is classified under CWE-285: Improper Authorization and requires only valid low-privilege credentials to exploit over the network.

Critical Impact
Authenticated low-privilege users of Jira Align can read a small amount of data from endpoints they should not be able to access, resulting in cross-tenant or cross-team information disclosure.

Affected Products

Atlassian Jira Align (cloud offering)
Affected versions tracked under JIRAALIGN-8646
Customers on unpatched Jira Align instances

Discovery Timeline

2025-10-22 - CVE CVE-2025-22177 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2025-22177

Vulnerability Analysis

The vulnerability sits in Jira Align's server-side authorization layer. Authenticated endpoints that return team and organization context do not consistently verify whether the requesting user is a member of the resource being queried. As a result, a user holding a low-privilege role can issue direct requests to these endpoints and receive data belonging to other teams.

The exposure is limited in scope. The vendor describes the disclosure as a small amount of sensitive information, specifically naming team overview data as one impacted view. There is no indication that write operations, authentication material, or administrative APIs are affected.

The weakness aligns with CWE-285, which covers cases where an application performs an action without correctly checking that the actor is authorized. Public exploitation has not been reported, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

Missing or incomplete authorization checks on specific Jira Align API endpoints allow horizontal access across tenant boundaries. The application appears to validate authentication (session or token) without enforcing the resource-level permission required for the requested object.

Attack Vector

An attacker needs a valid, low-privilege Jira Align account on the target instance. From there, the attacker sends crafted HTTP requests to the vulnerable endpoints and parses the returned JSON for data belonging to other teams. No social engineering, user interaction, or privilege escalation is required. Technical details beyond the vendor description are not published. Refer to the Atlassian JIRAALIGN-8646 advisory for official information.

Detection Methods for CVE-2025-22177

Indicators of Compromise

Authenticated API requests from low-privilege accounts to team, program, or organization endpoints they do not belong to.
Elevated request volume from a single Jira Align user session enumerating sequential team or object identifiers.
Successful HTTP 200 responses from endpoints that historically returned HTTP 403 for the same account.

Detection Strategies

Review Jira Align audit and access logs for cross-team data reads tied to accounts without the corresponding role assignment.
Baseline normal API usage per role and alert on deviations where low-privilege users touch administrative or multi-team endpoints.
Correlate user activity against role membership in the identity provider to surface mismatches.

Monitoring Recommendations

Forward Jira Align application and access logs to a central analytics platform for long-term retention and search.
Build dashboards that track per-user endpoint diversity and flag sudden expansion in accessed object IDs.
Enable alerting on anomalous enumeration patterns, such as sequential object ID access or high read-to-write ratios.

How to Mitigate CVE-2025-22177

Immediate Actions Required

Confirm the Jira Align instance version against the fix noted in JIRAALIGN-8646 and apply the vendor update.
Audit low-privilege account activity for the preceding months to identify any cross-team data access.
Review and tighten role assignments, removing standing access that is not required for job function.

Patch Information

Atlassian tracks the fix under JIRAALIGN-8646. Jira Align is primarily delivered as a managed service, so most customers receive the fix through the Atlassian cloud update cycle. Self-managed or regulated deployments should coordinate with Atlassian support to confirm the patched build is active.

Workarounds

Restrict Jira Align access to known corporate networks or identity-proxied sessions until the patched build is confirmed.
Reduce the number of users holding non-essential low-privilege roles that can reach the affected endpoints.
Rotate API tokens for service accounts that have interacted with team or program endpoints during the exposure window.

bash

# Example: query Jira Align audit logs for cross-team reads by a low-privilege user
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://<tenant>.jiraalign.com/api/audit?user=<user_id>&action=read" \
  | jq '.[] | select(.resourceTeamId != .userTeamId)'