CVE-2024-50617
Published: 11 February 2026
Summary
CVE-2024-50617 is a high-severity Improper Authorization (CWE-285) vulnerability in Cipplanner Cipace. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-50617 is a vulnerability in the File Download and Get File handler components of CIPPlanner CIPAce versions before 9.17. It enables attackers to download unauthorized files by modifying the file ID parameter or supplying the physical file path directly in the URL query string, bypassing intended data access controls for documents. The issue stems from improper authorization (CWE-285) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact over the network with low complexity and no privileges required.
Attackers can exploit this vulnerability remotely without authentication by crafting malicious requests to the affected handlers. Successful exploitation allows retrieval of sensitive files that should be restricted, potentially exposing confidential data depending on the system's document storage and access configurations.
CIPPlanner has issued a public notification of resolution for CVE-2024-50617, available at https://cipplanner.com/cve-2024-50617-cve-public-notification-of-resolution/. Security practitioners should consult this advisory for details on patches and mitigation steps, and upgrade to CIPAce 9.17 or later to address the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-55425
Vulnerability details
Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL…
more
query string to retrieve the files. (Retrieval is not intended without correct data access configured for documents.)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthorized file access via web handlers on a public-facing app due to missing authorization checks.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 requires enforcement of approved authorizations for access to system resources like files, directly preventing unauthorized downloads via manipulated file ID or path parameters in CIPPlanner CIPAce handlers.
SI-10 mandates validation of inputs such as URL query parameters for file IDs and paths, blocking manipulation that bypasses data access controls in the vulnerable File Download and Get File handlers.
AC-24 ensures explicit authorization decisions for access to specific system resources like documents, addressing the improper authorization that allows retrieval of unauthorized files.