CVE-2026-55082 in DHIS2
Summary
by MITRE • 07/21/2026
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with access to SQL View execution could manipulate SQL generated for SQL View filters and potentially access data outside the intended SQL View result set.
This is distinct from CVE-2026-55084, which tracks the related SQL View filter column-name injection.
Known affected release lines for this advisory: DHIS2 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates. Patched by the 2026-06-09 EOS security updates for 2.37, 2.38, and 2.39. The same value-slot hardening was already present on later supported branches through DHIS2-20174 / PR #22253.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in DHIS2 represents a critical SQL injection flaw that exploits the system's SQL View data endpoints to manipulate query execution. This security weakness specifically targets authenticated users who possess SQL View access permissions, creating an attack vector where malicious input can be interpolated directly into generated SQL statements. The flaw occurs during the processing of filter values within SQL View operations, allowing attackers to craft specific inputs that alter the intended database query behavior. Such manipulation enables unauthorized data access beyond what the original SQL View configuration was designed to permit, fundamentally undermining the system's data access controls and integrity mechanisms.
The technical implementation of this vulnerability stems from inadequate input sanitization within the SQL View filter processing logic. When authenticated users provide filter parameters through the SQL View endpoints, the system fails to properly escape or validate these inputs before incorporating them into dynamically generated SQL queries. This pattern of interpolation creates a classic SQL injection scenario where attacker-controlled data can modify the logical structure of database operations. The vulnerability specifically affects the filter value handling mechanism rather than column name injection as seen in CVE-2026-55084, indicating that the attack surface is focused on parameter manipulation within existing query structures rather than schema-level modifications.
The operational impact of this vulnerability extends beyond simple data exposure to encompass potential system compromise and unauthorized access to sensitive information. Authenticated users with SQL View permissions can exploit this flaw to retrieve data from tables or views they should not normally have access to, potentially exposing confidential organizational information. The attack requires only authentication credentials and existing SQL View access rights, making it particularly dangerous in environments where multiple users have varying levels of database access permissions. This vulnerability undermines the principle of least privilege enforcement within DHIS2's access control model and could facilitate further escalation attacks if combined with other system weaknesses.
Organizations running affected DHIS2 versions should immediately implement the security updates released on 2026-06-09, which address this specific SQL injection vulnerability through enhanced input validation and proper parameterization of SQL queries. The patching strategy specifically targets the affected release lines including versions 2.37, 2.38, and 2.39, with the security update incorporating value-slot hardening mechanisms already implemented in later supported branches. System administrators should conduct thorough testing of the patched environment to ensure that legitimate SQL View functionality remains intact while the vulnerability is resolved. This remediation aligns with industry best practices for SQL injection prevention and follows established security frameworks that emphasize proper input validation and parameterized queries to protect against database manipulation attacks.
This vulnerability type maps directly to CWE-89 which defines SQL injection as the insertion of malicious SQL code into query statements, and relates to ATT&CK technique T1078 which covers valid accounts for maintaining access. The attack vector represents a privilege escalation scenario where legitimate authenticated users leverage their existing permissions to expand their data access capabilities through manipulation of system interfaces rather than brute force authentication bypasses. The security controls implemented in the patch demonstrate adherence to secure coding practices that emphasize defensive programming techniques and proper database query construction to prevent unauthorized data access patterns.