CVE-2025-22170
📋 TL;DR
Jira Align has an authorization bypass vulnerability where low-privilege users can perform actions they shouldn't by including a state-related parameter from a privileged user. This affects all Jira Align instances where users have different permission levels.
💻 Affected Systems
- Atlassian Jira Align
📦 What is this software?
Jira Align by Atlassian
⚠️ Risk & Real-World Impact
Worst Case
Low-privilege users could perform administrative actions, modify critical data, or escalate their privileges to gain full system control.
Likely Case
Users could perform actions outside their intended permissions, potentially modifying project data, settings, or accessing restricted information.
If Mitigated
With proper access controls and monitoring, impact would be limited to minor unauthorized actions that could be detected and rolled back.
🎯 Exploit Status
Requires authenticated low-privilege user and knowledge of privileged user's state parameter. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Atlassian advisory for specific fixed versions
Vendor Advisory: https://jira.atlassian.com/browse/JIRAALIGN-8639
Restart Required: No
Instructions:
1. Check Atlassian advisory for fixed version. 2. Update Jira Align to patched version. 3. For cloud instances, verify Atlassian has applied the patch.
🔧 Temporary Workarounds
Temporary Access Restriction
allLimit low-privilege user access to only essential functions while awaiting patch
🧯 If You Can't Patch
- Implement strict access controls and principle of least privilege
- Enable detailed audit logging for all user actions and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Jira Align version against Atlassian's advisory. Test with low-privilege user attempting actions with privileged user parameters.Check Version:
Check Jira Align administration panel or consult Atlassian documentation for version check commandVerify Fix Applied:
Verify Jira Align version is updated to patched version. Test that low-privilege users can no longer perform unauthorized actions with privileged parameters.📡 Detection & Monitoring
Log Indicators:
- Unusual user actions from low-privilege accounts
- Failed authorization attempts followed by successful privileged actions
Network Indicators:
- Requests containing state parameters from different user sessions
SIEM Query:
source="jira-align" AND (user.privilege="low" AND action="privileged_operation")