Which versions of DHIS2 are affected by CVE-2026-55082?

DHIS2 health information systems in versions 2.37-2.39 contain a SQL injection vulnerability enabling authenticated users to bypass security controls and access patient data beyond their authorized…

How to fix or mitigate CVE-2026-55082?

Within 24 hours, identify and inventory all DHIS2 instances running versions 2.37, 2.38, or 2.39 in production; immediately restrict SQL View execution permissions to only essential authorized personnel and audit existing permission grants. Within 7 days, contact DHIS2 vendor support to determine current patch availability and apply all available security updates; simultaneously review SQL View query logs from the past 30 days for suspicious or unauthorized data access attempts. Within 30 days, ensure all affected instances have available patches applied; conduct a comprehensive security review of all SQL View definitions to confirm they access only intended data scopes; and implement additional input validation on filter parameters to prevent injection attacks.

DHIS2 CVE-2026-55082

Q: What is the CVSS score of CVE-2026-55082?

CVE-2026-55082 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46351 HIGH

SQL Injection (CWE-89)

2026-07-21 security-advisories@github.com

SQLi

8.7

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Requires an authenticated account with SQL View access (PR:L) reachable over the network at low complexity; description shows data disclosure beyond scope (C:H), with limited integrity and no clear availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 21, 2026 - 19:31 vuln.today

Analysis Generated

Jul 21, 2026 - 19:31 vuln.today

CVE Published

Jul 21, 2026 - 19:17 cve.org

HIGH 8.7

DescriptionCVE.org

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with access to SQL View execution could manipulate SQL generated for SQL View filters and potentially access data outside the intended SQL View result set.

This is distinct from CVE-2026-55084, which tracks the related SQL View filter column-name injection.

Known affected release lines for this advisory: DHIS2 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates. Patched by the 2026-06-09 EOS security updates for 2.37, 2.38, and 2.39. The same value-slot hardening was already present on later supported branches through DHIS2-20174 / PR #22253.

AnalysisAI

SQL injection in DHIS2 SQL View data endpoints lets an authenticated user with SQL View execution access supply crafted filter values that are interpolated directly into the generated SQL, allowing them to read data outside the intended SQL View result set. It affects release lines 2.37, 2.38 and 2.39 prior to the 2026-06-09 End-of-Support security updates and carries a vendor CVSS 4.0 score of 8.7 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix reworks filter handling to use parameterized placeholders instead of string interpolation.

Technical ContextAI

DHIS2 is a widely used open-source health information platform for data capture, validation, analytics and visualization. The SQL View feature lets privileged users define and run stored SQL queries; the affected code path (DefaultSqlViewService.parseFilters / getFilterQuery / getSqlForView in dhis-service-administration) built the WHERE clause by concatenating user-supplied filter values into the SQL string. This is a classic CWE-89 SQL Injection root cause: untrusted input crossing into a SQL statement without parameterization. The remediation (PR #22253, DHIS2-20174) refactors the value slots to return a PlaceholderQueryWithArgs structure, passing bound arguments (Object[] args) through populateSqlViewGrid so filter values are supplied as JDBC bind parameters rather than interpolated text.

RemediationAI

Apply the 2026-06-09 EOS security updates for the 2.37, 2.38 or 2.39 line as applicable, or upgrade to a later supported DHIS2 branch that already includes the value-slot parameterization from DHIS2-20174 / PR #22253; consult GHSA-3288-cm98-664f (https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3288-cm98-664f) and the referenced pull requests (22253, 24172, 24173, 24174) for exact backport commits. Where patching must be deferred, restrict SQL View execution authority by revoking the SQL View execution/read authorities from non-administrative users so only fully trusted operators can run views (trade-off: reporting users relying on SQL Views lose that capability), and audit existing SQL Views and access logs for anomalous filter parameters indicating exfiltration attempts. Running the application database account with least privilege (read-only, scoped to required schemas) limits blast radius but may break legitimate write-oriented views.