SQL Injection Vulnerability in DHIS2 Information System
CVE-2026-55082

8.7HIGH

Key Information:

Vendor

Dhis2

Status
Dhis2-core
Vendor
CVE Published:
21 July 2026

What is CVE-2026-55082?

The DHIS2 information system features a vulnerability where authenticated users with SQL View access can manipulate SQL queries through crafted filter values. This allows them to potentially gain unauthorized access to data beyond their intended SQL View result set. To mitigate this risk, updates were issued on 2026-06-09, enhancing security mechanisms against such SQL View filter manipulations in versions 2.37, 2.38, and 2.39.

Affected Version(s)

dhis2-core = 2.37 = 2.37

dhis2-core = 2.38 = 2.38

dhis2-core = 2.39 = 2.39

References

https://github.com/dhis2/dhis2-core/security/advisories/G...
x_refsource_CONFIRM
https://github.com/dhis2/dhis2-core/pull/22253
x_refsource_MISC
https://github.com/dhis2/dhis2-core/pull/24172
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.