CVE-2024-50617
Published: 11 February 2026
Summary
CVE-2024-50617 is a high-severity Improper Authorization (CWE-285) vulnerability in Cipplanner Cipace. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documented procedures facilitate correct implementation and ongoing management of authorization decisions.
Periodic reviews identify and correct flaws in authorization decisions or enforcement.
The control's documentation requirement reduces improper authorization by ensuring only mission-justified actions bypass authentication.
Establishing permitted attributes and values, plus auditing changes, ensures authorization decisions are based on correctly managed policy data.
Explicitly mandates authorizing remote access types before permitting connections, directly mitigating improper authorization.
The control explicitly requires authorization of each wireless access type prior to permitting connections.
Mandating explicit authorization of mobile device connections reduces the risk of improper authorization decisions for system access.
Specifying access authorizations for each account and requiring approvals for account requests enforces proper authorization decisions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthorized file access via web handlers on a public-facing app due to missing authorization checks.
NVD Description
Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL…
more
query string to retrieve the files. (Retrieval is not intended without correct data access configured for documents.)
Deeper analysisAI
CVE-2024-50617 is a vulnerability in the File Download and Get File handler components of CIPPlanner CIPAce versions before 9.17. It enables attackers to download unauthorized files by modifying the file ID parameter or supplying the physical file path directly in the URL query string, bypassing intended data access controls for documents. The issue stems from improper authorization (CWE-285) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact over the network with low complexity and no privileges required.
Attackers can exploit this vulnerability remotely without authentication by crafting malicious requests to the affected handlers. Successful exploitation allows retrieval of sensitive files that should be restricted, potentially exposing confidential data depending on the system's document storage and access configurations.
CIPPlanner has issued a public notification of resolution for CVE-2024-50617, available at https://cipplanner.com/cve-2024-50617-cve-public-notification-of-resolution/. Security practitioners should consult this advisory for details on patches and mitigation steps, and upgrade to CIPAce 9.17 or later to address the issue.
Details
- CWE(s)