CVE-2024-50617
High
Description
Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL query string to retrieve the files. (Retrieval is not intended without correct data access configured for documents.)
SeverityHigh
CVSS7.5
Exploit probability—
ProductCipplanner Cipace
PublishedFeb 11, 2026
First seenFeb 11, 2026
Weakness typeCWE-285CWE-285
How to fix
Update
- cipplanner cipace9.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cipplanner cipace | v < 9.17 | 9.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.