Jira Align
CVE-2025-22170
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege Jira Align user
-
ExploitCraft request with privileged user's state parameter
-
ExecutionBypass server-side authorization check
-
ImpactPerform unauthorized integrity-affecting action
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege Jira Align account (PR:L); the attacker must submit a request that includes a specific state-related parameter belonging to a user who holds sufficient privileges for the target action, causing the authorization check to be bypassed. Limiting factors: a valid authenticated session is mandatory (not remote-unauthenticated), no victim user interaction is involved (UI:N), and impact is confined to low integrity (VI:L) with no confidentiality or availability effect - so an external attacker must first obtain or be provisioned a low-privilege account on the instance. |
| Impact | This is a moderate, authenticated authorization flaw (CWE-285) rather than a high-urgency issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires an existing low-privilege account (PR:L), and impact is limited to integrity only (VI:L; VC:N, VA:N) - no confidentiality or availability loss and no scope change (all subsequent-system metrics N). All exploitation signals point the same direction and are consistent: EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit was identified, so this reflects no public exploit identified at time of analysis. SSVC-style reading: exploitation is not observed, technical impact is partial, and automatability is unlikely given the required authenticated context and app-specific parameter manipulation. The CVSS 4.0 base score of 5.3 (Medium) aligns with the limited integrity-only impact. No conflicting signals were found between the CVSS vector and the description - both agree on authenticated, network-based access with limited impact. This is a legitimate patch-in-normal-cycle item for Jira Align operators, not an emergency; prioritize based on whether untrusted or many low-privilege users have access to the instance. |
| Exploit ScenarioDerived | An attacker who already holds a valid low-privilege Jira Align account crafts an application request that unlawfully includes a state-related parameter associated with a higher-privileged user, causing the server to perform an action the attacker is not authorized to perform. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, this needs only authenticated network access and no victim interaction, though it is limited to low integrity impact. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Improper authorization in Atlassian Jira Align allows an authenticated low-privilege user to perform actions they are not entitled to by supplying a state-related parameter that belongs to a user who does hold the required privileges, effectively bypassing the per-user permission check (CWE-285). The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N confirms the attacker must hold a valid low-privilege account (PR:L, so not unauthenticated access), needs no victim interaction, and can achieve only a low-integrity impact with no confidentiality or availability loss. Risk is moderate rather than urgent: EPSS is 0.21% (10th percentile), there is no CISA KEV entry, no POC is referenced, and exploitation requires an already-provisioned account on the instance.
RemediationAI
No vendor-released patch version is specified in the available intelligence, so the authoritative step is to monitor and read Atlassian's advisory at https://jira.atlassian.com/browse/JIRAALIGN-8639 (issue JIRAALIGN-8639) and apply the fixed Jira Align release as soon as Atlassian publishes it; confirm the exact patched version from that advisory rather than assuming one. Until a patch is confirmed, deploy compensating controls that directly target the broken authorization path: ensure the request-handling layer binds every state-related parameter to the authenticated session principal and rejects or logs any request whose state/user parameter does not match the session user, since the current behavior is exactly that mismatch; audit and minimize the population of low-privilege accounts on internet-facing instances, because the flaw requires a valid authenticated session and reducing account issuance reduces the exposed attack surface (trade-off: less convenient access and more onboarding friction for contractors and testers). Where feasible, restrict Jira Align reachability to trusted networks, VPN, or an IP allowlist and front it with a WAF rule that flags anomalous requests carrying foreign user-state parameters (trade-off: legitimate integrations and remote users may be blocked or throttled, and WAF signatures for this semantic flaw are heuristic and will not stop a careful attacker). Enable and retain detailed audit logging for authorization-sensitive actions so that any successful bypass is at least detectable, acknowledging this is detective rather than preventive. Because exploitation requires a pre-existing low-privilege account, credential hygiene and prompt deprovisioning of stale or unused accounts are meaningful interim mitigations; note there is currently no public exploit code or KEV-confirmed active exploitation, so these measures should be prioritized by the moderate, integrity-only impact assessed rather than treated as emergency actions.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jira Align is Atlassian's enterprise-scale agile planning (SAFe) platform, deployed as a web application with a role- and privilege-based authorization model layered on top of its user and program/portfolio state objects. The root cause class here is CWE-285, Improper Authorization: the server appears to derive the effective privilege context from a client-supplied, state-related parameter (for example, an identifier or state token associated with a privileged user) rather than binding the authorization decision strictly to the authenticated session principal. Because the request still travels over the network and the application implements no additional access control beyond the flawed check, an attacker who can manipulate that parameter causes the backend to evaluate the privileged user's rights instead of their own, letting a low-privilege actor trigger privileged operations. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) is consistent with the independent CVSS 3.1 assessment: network-reachable, low attack complexity, no attack requirements or race/configuration preconditions, low privileges required (authenticated), no user interaction, and integrity-only impact. The CPE cpe:2.3:a:atlassian:jira_align:*:*:*:*:*:*:*:* uses a wildcard version, meaning the advisory currently covers all tracked Jira Align releases rather than a single enumerated build.
Know when Jira Align gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable (AV:N) and low-complexity (AC:L) but needs an authenticated low-privilege account (PR:L); authorization bypass yields only limited integrity impact (I:L), with no confidentiality or availability effect.
Primary rating from Vendor (atlassian).
CVSS VectorVendor: atlassian
DescriptionCVE.org
Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Jira Align
View allThe MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the
Improper authorization in Atlassian Jira Align allows a remote authenticated low-privilege user to access endpoints outs
Authorization bypass in Atlassian Jira Align allows any authenticated low-privilege user to reach endpoints that should
Authenticated low-privilege users of Atlassian Jira Align can access restricted endpoints and disclose limited sensitive
Improper authorization in Atlassian Jira Align lets a low-privilege authenticated user reach endpoints that should be ga
Improper authorization in Atlassian Jira Align lets an authenticated low-privilege user reach endpoints that fail to enf
Authenticated low-privilege users of Atlassian Jira Align can reach application endpoints they are not authorized to use
Improper authorization checks in Atlassian Jira Align allow an authenticated low-privilege user to reach endpoints beyon
Improper authorization in Atlassian Jira Align's checklist feature lets any authenticated user with low privileges modif
Jira Align's broken object-level authorization permits an authenticated low-privilege user to access or modify limited r
Missing per-endpoint authorization checks in Atlassian Jira Align allow any authenticated low-privilege user to reach en
The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this iss
GitHub PoC
Exploit-DB