CVE-2026-91997CWE-697

CVE-2026-91997

Medium · published September 15, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-697 · Incorrect Comparison
Published
2026-09-15T16:17Z
References (4)
https://github.com/evolution-foundation/evolution-api · [email protected]https://github.com/evolution-foundation/evolution-api/blob/2.3.7/src/api/routes/index.router.ts#L49-L65 · [email protected]https://github.com/geo-chen/oss/blob/main/evolution-api.md · [email protected]https://www.vulncheck.com/advisories/evolution-api-through-2.3.7-prometheus-metrics-ip-allowlist-bypass · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 11:35Z
    evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass
    cvelistv5