What is the CVSS score of CVE-2024-50617?

CVE-2024-50617 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Cipace are affected by CVE-2024-50617?

CIPPlanner CIPAce versions before 9.17 contain a critical file access vulnerability that allows authenticated users to bypass authorization controls and download sensitive files they should not…

How to fix or mitigate CVE-2024-50617?

Within 24 hours: Identify all CIPAce instances and their versions; disable file download functionality if operationally feasible, or restrict access to trusted networks only. Within 7 days: Implement Web Application Firewall (WAF) rules to block suspicious file path traversal patterns in URL queries; review access logs for unauthorized file access attempts. Within 30 days: Contact vendor for patch availability and timeline; develop upgrade plan to version 9.17 or later; conduct audit of files accessed by low-privilege users.

Cipace CVE-2024-50617

HIGH

Improper Authorization (CWE-285)

2026-02-11 cve@mitre.org

Authentication Bypass Cipace

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 22:15 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL query string to retrieve the files. (Retrieval is not intended without correct data access configured for documents.)

AnalysisAI

Technical ContextAI

Classified as CWE-285 (Improper Authorization). Affects the File Download and Get File component of Cipace. Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL query string to retrieve the files. (Retrieval is not intended without correct data access configured for documents.)