CVE-2026-55081 in DHIS2
Summary
by MITRE • 07/21/2026
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value could be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker able to get a user to open a crafted OpenAPI HTML URL could execute JavaScript in that user's browser in the DHIS2 origin.
Affected versions: DHIS2 2.42 and 2.43 before the 2026-06-09 security patch releases, and the development branch for DHIS2 2.44 before the fix was merged. Patched in 2.42.5.1, 2.43.0.1, the 2.42 and 2.43 line branches, and the 2.44 development branch.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability represents a classic cross-site scripting flaw within the DHIS2 OpenAPI documentation interface, specifically affecting versions 2.42 and 2.43 prior to their respective security patches released in June 2026. The issue stems from insufficient input sanitization of the scope query parameter, which is processed by the HTML endpoint and directly embedded into generated documentation pages without proper output encoding or validation. When a malicious user crafts a specially formatted scope parameter containing HTML or JavaScript code, this content gets reflected back to any user who accesses the affected OpenAPI page, creating an environment where client-side attacks can be executed through simple navigation to the crafted URL.
The technical exploitation of this vulnerability aligns with CWE-79 "Cross-site Scripting" and follows patterns commonly associated with reflected XSS attacks as documented in the ATT&CK framework under technique T1566.001 "Phishing via Service Provider". The flaw exists because the application fails to properly validate or sanitize user-supplied input before incorporating it into dynamically generated HTML content, allowing malicious payloads to persist within the documentation interface where they execute with the privileges of the victim user's browser session. This particular implementation allows attackers to inject arbitrary JavaScript that executes in the context of the DHIS2 application origin, potentially enabling session hijacking, data exfiltration, or further exploitation of the authenticated user's privileges.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with a vector for more sophisticated attacks within the DHIS2 ecosystem. Since DHIS2 is designed for healthcare and public health data management, an attacker could potentially leverage this vulnerability to access sensitive patient information, manipulate data through session manipulation, or establish persistence mechanisms within the system. The reflected nature of the attack means that users must be convinced to navigate to a malicious URL containing the crafted scope parameter, making this vulnerability particularly dangerous in social engineering scenarios where attackers might trick users into clicking on compromised links within phishing campaigns or malicious documentation.
Mitigation strategies for this vulnerability should focus on implementing proper input validation and output encoding mechanisms throughout the OpenAPI documentation generation process. Organizations using DHIS2 should immediately apply the security patches released in versions 2.42.5.1, 2.43.0.1, and the corresponding fixes in the 2.44 development branch. Additionally, administrators should implement web application firewalls to monitor for suspicious scope parameter values and establish network-level controls to restrict access to sensitive documentation endpoints where possible. The fix implemented by DHIS2 developers addresses the root cause by ensuring all user-supplied input is properly sanitized before being incorporated into HTML output, preventing any potentially malicious code from executing in the victim's browser context. This remediation aligns with industry best practices for XSS prevention as outlined in OWASP Top Ten and NIST Cybersecurity Framework guidelines for secure coding practices.