https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-50619.htmlhttps://patchthecve.com/cve/CVE-2024-50619.htmlWed, 17 Jun 2026 08:04:49 +0000HIGH 8.8: Vulnerabilities in the My Account and User Management components in CIPPlanner CIPAce before 9.17 allows attackers to escalate their access levels. A low-privileged authenticated user can gain access to other people's accounts by tampering with the client's user id to change their account informatiohttps://patchthecve.com/cve/CVE-2024-50617.htmlhttps://patchthecve.com/cve/CVE-2024-50617.htmlWed, 17 Jun 2026 08:04:49 +0000HIGH 7.5: Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL query string to retrieve the files. (Retrievalhttps://patchthecve.com/cve/CVE-2024-50620.htmlhttps://patchthecve.com/cve/CVE-2024-50620.htmlWed, 17 Jun 2026 08:04:49 +0000HIGH 8.8: Unrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and document manage components in CIPPlanner CIPAce before 9.17. An authorized user can upload executable files when inserting images in the rich text editor, and upload executable files when uploading filehttps://patchthecve.com/cve/CVE-2024-50618.htmlhttps://patchthecve.com/cve/CVE-2024-50618.htmlWed, 17 Jun 2026 08:04:49 +0000MEDIUM 4.3: A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mechanism. When the system is configured to allow login with internal accounts, an attacker can possibly obtain full authentication if the secr