Which versions of DHIS2 are affected by EUVD-2026-46362?

DHIS2 core versions 2.42 and 2.43 contain a reflected cross-site scripting vulnerability in the OpenAPI documentation endpoint that allows attackers to hijack authenticated user sessions.. A patch is available.

How to fix or mitigate EUVD-2026-46362?

Within 24 hours: identify all deployed DHIS2 versions in production and development environments; review recent access logs for suspicious OpenAPI endpoint requests with unusual query parameters. Within 7 days: upgrade all DHIS2 2.42 and 2.43 installations to versions released on or after 2026-06-09 (e.g., 2.42.5, 2.43.3 or later per vendor advisory); monitor vendor announcements for patched 2.44 release. Within 30 days: verify all upgrades across all environments, conduct security audit of administrative access and session activity for signs of compromise, and execute user awareness training on phishing and malicious link risks.

DHIS2 EUVD-2026-46362

Q: What is the CVSS score of EUVD-2026-46362?

EUVD-2026-46362 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-55081 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-21 GitHub_M

XSS Dhis2 Core Dhis2

7.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Reflected XSS reachable only by an authenticated user (PR:L) who must click a crafted link (UI:R); injected script crosses into the browser context (S:C) enabling session/data theft (C:H), while I set AC:L as straightforward reflection.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 21, 2026 - 20:18 EUVD

Source Code Evidence Fetched

Jul 21, 2026 - 19:03 vuln.today

Analysis Generated

Jul 21, 2026 - 19:03 vuln.today

CVE Published

Jul 21, 2026 - 18:36 cve.org

HIGH 7.3

DescriptionCVE.org

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker able to get a user to open a crafted OpenAPI HTML URL could execute JavaScript in that user's browser in the DHIS2 origin.

Affected versions: DHIS2 2.42 and 2.43 before the 2026-06-09 security patch releases, and the development branch for DHIS2 2.44 before the fix was merged. Patched in 2.42.5.1, 2.43.0.1, the 2.42 and 2.43 line branches, and the 2.44 development branch.

AnalysisAI

Reflected cross-site scripting in the DHIS2 OpenAPI HTML documentation endpoint allows an attacker to execute arbitrary JavaScript in a victim's browser within the DHIS2 origin by luring an authenticated user to a crafted URL. The endpoint echoes the scope query parameter into the generated HTML page without sufficient sanitization (CWE-79), affecting DHIS2 core versions 2.42 and 2.43 prior to the 2026-06-09 security releases and the 2.44 development branch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but successful exploitation can hijack the victim's DHIS2 session and act with their privileges.

Technical ContextAI

DHIS2 is an open-source, Java/Spring-based health management information platform (cpe:2.3:a:dhis2:dhis2-core) used to capture, validate, analyze and visualize aggregate and event data. The affected component is the built-in OpenAPI documentation renderer, which produces an HTML page describing the API; the scope query parameter is reflected into that document. Because the value is inserted into the HTML/JavaScript context without adequate output encoding, it becomes a classic reflected XSS (CWE-79, Improper Neutralization of Input During Web Page Generation). The injected script runs in the DHIS2 web origin, so it inherits the victim's authenticated session context, cookies, and same-origin access to DHIS2 APIs.

RemediationAI

Vendor-released patch: upgrade to 2.42.5.1 or 2.43.0.1 (or the latest patched 2.42/2.43 line branch build), and for pre-release use pull the fixed 2.44 development branch, per advisory https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6785-hj47-c27h. If immediate patching is not possible, restrict or block access to the OpenAPI HTML documentation endpoint at the reverse proxy (many production deployments do not need the interactive OpenAPI docs exposed to end users), which removes the reflection surface at the cost of losing in-app API documentation; additionally deploy a strict Content-Security-Policy that disallows inline script execution on the DHIS2 origin to blunt reflected XSS, accepting that a restrictive CSP may break some bundled apps and require tuning. Educate operators not to open OpenAPI URLs received from untrusted sources, since exploitation depends on the victim clicking a crafted link.