CVE-2026-55082
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in DHIS2 SQL View data endpoints. Authenticated users with SQL View access can provide crafted filter values that are interpolated into generated SQL, potentially accessing data outside the intended result set.
Risk Assessment
An attacker could access data they are not authorized to see, potentially compromising data confidentiality and integrity in DHIS2.
Recommendation
Apply the 2026-06-09 EOS security updates for DHIS2 versions 2.37, 2.38, and 2.39. For later versions, ensure they include the DHIS2-20174 fix.
Other vulnerabilities in DHIS2
See all- CVE-2026-55084High
DHIS2 (versions 2.37-2.44) contains a SQL injection vulnerability in the SqlView API endpoint. An authenticated user with SqlView access can inject arbitrary SQL queries via the filter parameter by abusing a PostgreSQL expression, with output reflected in error messages.
- CVE-2026-55081High
XSS vulnerability in DHIS2 versions 2.42 and 2.43 before the 2026-06-09 security patches, and in the 2.44 development branch. An attacker can inject active HTML or JavaScript via the scope parameter in the OpenAPI HTML endpoint.
Original NVD description (English source)
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with access to SQL View execution could manipulate SQL generated for SQL View filters and potentially access data outside the intended SQL View result set. This is distinct from CVE-2026-55084, which tracks the related SQL View filter column-name injection. Known affected release lines for this advisory: DHIS2 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates. Patched by the 2026-06-09 EOS security updates for 2.37, 2.38, and 2.39. The same value-slot hardening was already present on later supported branches through DHIS2-20174 / PR #22253.