Beveiligingsadvies

CVE-2026-91997

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-15 11:35:51

Laatst bijgewerkt 2026-09-15 11:54:53

Toegewezen door VulnCheck

CVSS-score 6.9

Status PUBLISHED

Beschrijving

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.

← Alle CVE's bekijken Bekijk op cve.org ↗