CVE-2026-55081: DHIS2 OpenAPI XSS Vulnerability

CVE-2026-55081 Overview

CVE-2026-55081 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the District Health Information Software 2 (DHIS2) OpenAPI HTML endpoint. The endpoint reflects values from the scope query parameter into the generated HTML document without sufficient sanitization. An attacker who convinces an authenticated user to open a crafted OpenAPI HTML URL can execute arbitrary JavaScript in that user's browser under the DHIS2 origin.

DHIS2 is a flexible information system used globally for data capture, management, validation, analytics, and visualization, including in public health deployments.

Critical Impact
Successful exploitation allows attackers to execute JavaScript in a victim's browser session under the DHIS2 origin, enabling session theft, data exfiltration, and actions on behalf of the user.

Affected Products

DHIS2 2.42 before the 2026-06-09 security patch release (2.42.5.1)
DHIS2 2.43 before the 2026-06-09 security patch release (2.43.0.1)
DHIS2 2.44 development branch prior to the merged fix

Discovery Timeline

2026-07-21 - CVE-2026-55081 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-55081

Vulnerability Analysis

The vulnerability resides in the DHIS2 OpenAPI HTML documentation endpoint. The endpoint accepts a scope query parameter and reflects its value directly into the generated HTML response. Because the input is not properly encoded or sanitized before rendering, an attacker can supply a crafted scope value containing HTML markup or JavaScript. The browser then parses the reflected content as active markup rather than as inert text.

The attack requires a low-privileged authenticated user to open a malicious link. Once executed, the payload runs within the DHIS2 origin, granting access to session cookies, CSRF tokens, and any data or API endpoints the victim can reach.

Root Cause

The root cause is missing output encoding on user-controllable input reflected into an HTML response. The scope parameter value flows from the request into the HTML template without contextual escaping for HTML, attribute, or JavaScript contexts, satisfying the classic reflected XSS pattern captured by CWE-79.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL to the DHIS2 OpenAPI HTML endpoint with a malicious scope parameter value and delivers it via phishing, chat, or an embedded link. When the authenticated victim opens the URL, the injected script executes in the DHIS2 origin. See the GitHub Security Advisory GHSA-6785-hj47-c27h for additional technical detail.

Detection Methods for CVE-2026-55081

Indicators of Compromise

Access log entries to the DHIS2 OpenAPI HTML endpoint containing scope= query values with characters such as <, >, ", ', script, onerror, or URL-encoded equivalents (%3C, %3E).
Unexpected outbound requests from browsers immediately following visits to OpenAPI documentation URLs.
Session activity from a user account originating from unusual IP addresses shortly after a reported click on an OpenAPI link.

Detection Strategies

Inspect web server and reverse proxy logs for requests to the OpenAPI HTML endpoint with suspicious scope values and alert on payload signatures common to XSS.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts on DHIS2 pages.
Correlate authenticated user sessions with anomalous API calls made shortly after visiting the OpenAPI documentation page.

Monitoring Recommendations

Forward DHIS2 application, reverse proxy, and Web Application Firewall (WAF) logs to a centralized analytics platform for URL parameter inspection.
Monitor for repeated failed or malformed requests to /openapi HTML endpoints across user accounts.
Track browser CSP violation reports for the DHIS2 origin to identify blocked injection attempts.

How to Mitigate CVE-2026-55081

Immediate Actions Required

Upgrade DHIS2 to a fixed release: 2.42.5.1, 2.43.0.1, or the patched 2.42 and 2.43 line branches.
If running the 2.44 development branch, pull the branch containing the merged fix.
Rotate active user sessions after patching to invalidate any credentials that may have been captured.

Patch Information

The DHIS2 project addressed the vulnerability in the 2026-06-09 security patch releases. Fixes are available in Pull Request #24158, Pull Request #24159, Pull Request #24160, Pull Request #24161, and Pull Request #24162. Full advisory details are in GHSA-6785-hj47-c27h.

Workarounds

Restrict access to the DHIS2 OpenAPI HTML endpoint at the reverse proxy or WAF layer until patching is complete.
Deploy a strict Content Security Policy that disallows inline scripts on the DHIS2 origin to reduce the impact of reflected payloads.
Filter or block requests to the OpenAPI endpoint that contain HTML metacharacters in the scope parameter.

bash

# Example NGINX rule to block suspicious scope parameters on the OpenAPI endpoint
location ~* /openapi\.html$ {
    if ($arg_scope ~* "(<|>|script|onerror|onload|javascript:)") {
        return 403;
    }
    proxy_pass http://dhis2_backend;
}