What is the CVSS score of CVE-2026-55084?

CVE-2026-55084 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of DHIS2 are affected by CVE-2026-55084?

DHIS2 core SqlView API contains a high-severity SQL injection vulnerability affecting versions 2.37-2.44 that allows authenticated users with SqlView access to exfiltrate database content through…. A patch is available.

How to fix or mitigate CVE-2026-55084?

Within 24 hours, inventory all DHIS2 instances and document specific version numbers (affected: 2.37 through 2.44; note that 2.37-2.39 reached end-of-support on 2026-06-09) and SqlView access permissions to identify systems at risk. Within 7 days, implement compensating controls by restricting database user privileges to minimum required levels, limiting SqlView access to only authorized users, and disabling detailed error messages in API responses to prevent SQL injection payload reflection. Within 30 days, monitor the vendor advisory for patch release and plan an immediate upgrade to a patched version when available, prioritizing instances running affected versions with broad SqlView access.

DHIS2 CVE-2026-55084

EUVD-2026-46360 HIGH

SQL Injection (CWE-89)

2026-07-21 GitHub_M

PostgreSQL SQLi Dhis2 Core

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable API, low complexity, no interaction, but requires an authenticated user holding SqlView access (PR:L); arbitrary SQL injection enables data read, modification and DoS, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 21, 2026 - 20:18 EUVD

Source Code Evidence Fetched

Jul 21, 2026 - 19:02 vuln.today

Analysis Generated

Jul 21, 2026 - 19:02 vuln.today

CVE Published

Jul 21, 2026 - 18:30 cve.org

HIGH 8.8

DescriptionCVE.org

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/{viewId}/data.json endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the filter parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection.

Affected versions include: 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162 Patched versions include: 2.37-EOS (2026-06-09), 2.38-EOS (2026-06-09), 2.39-EOS (2026-06-09), 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, 2.44 development branch after PR #24162

AnalysisAI

Error-based SQL injection in the DHIS2 core SqlView API (the filter parameter of /api/sqlViews/{viewId}/data.json) lets an authenticated user who has access to a SqlView inject arbitrary SQL that PostgreSQL evaluates, with the result reflected in the application error message to exfiltrate arbitrary database content. It affects DHIS2 core across the 2.37 through 2.44 lines (2.37-2.39 reached end-of-support on 2026-06-09), and the root cause is an unquoted column name concatenated into the query, fixed in PR #24162 by wrapping it in SqlUtils.quote(). There is no public exploit identified at time of analysis and no CISA KEV listing, but the vendor-issued GHSA advisory and CVSS 8.8 mark it as a high-priority patch for any DHIS2 instance where SqlView access is broadly granted.

Technical ContextAI

DHIS2 is an open-source health information platform (dhis2-core, Java/Spring backed by a PostgreSQL database) used for data capture, validation, analytics and visualization, most prominently across national ministry-of-health deployments. The SqlView feature lets privileged users define and run stored SQL views; the data.json endpoint accepts a filter parameter compiled into a WHERE clause. The flaw is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): per the PR #24162 diff to DefaultSqlViewService.getFilterQuery(), the columnName derived from the filter was concatenated directly into the SQL string rather than quoted, so a crafted filter can inject a PostgreSQL expression whose evaluation error surfaces data back to the caller - classic error-based extraction. The affected component is identified by CPE cpe:2.3:a:dhis2:dhis2-core:*:*:*:*:*:*:*:* and the tags PostgreSQL, SQLi, and Dhis2 Core. Note: the same PR also adds an unrelated ObjectInputFilter deserialization hardening to HibernateUserSettingStore, which is defense-in-depth and not the SQLi fix itself.

RemediationAI

Vendor-released patch: upgrade to 2.40.11.1 or 2.40.12, 2.41.8.2, 2.42.5.1, or 2.43.0.1 depending on your branch (2.44 development builds must include PR #24162 or later); see GHSA-pwmg-mvjw-4m23 at https://github.com/dhis2/dhis2-core/security/advisories/GHSA-pwmg-mvjw-4m23 and the fix at https://github.com/dhis2/dhis2-core/pull/24162. The 2.37, 2.38 and 2.39 branches reached end-of-support on 2026-06-09 and receive no patch, so users on those lines must migrate to a supported release. As compensating controls until patched, revoke or tightly restrict the authorities that grant SqlView access so only trusted administrators retain it, and run the DHIS2 database connection under a least-privilege PostgreSQL role that cannot read or write outside the application schema to limit injected-query impact - the trade-off is that overly restrictive DB grants can break legitimate SqlView execution and analytics. Additionally, restrict network exposure of the /api/sqlViews/ endpoints via reverse-proxy or WAF rules where feasible, accepting that this may impede legitimate API-driven reporting.