What is CVE-2026-91997?

CVE-2026-91997 is a medium-severity vulnerability in Evolution-Foundation Evolution-Api, classified under Incorrect Comparison. CVSS score: 5.3/10. Published 2026-09-15.

How severe is CVE-2026-91997?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Evolution-Foundation Evolution-Api

CVE-2026-91997

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Evolution-foundation Evolution-api

Weakness classification (CWE)

CWE-697 — Incorrect Comparison

References

disclosure@vulncheck.com (exploit, third-party-advisory)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-91997?: CVE-2026-91997 is a medium-severity vulnerability in Evolution-Foundation Evolution-Api, classified under Incorrect Comparison. CVSS score: 5.3/10. Published 2026-09-15.
How severe is CVE-2026-91997?: Medium severity. CVSS v3 base score is 5.3 out of 10.