CVE-2026-55082: DHIS2 SQL Injection Vulnerability

CVE-2026-55082 Overview

CVE-2026-55082 is a SQL injection vulnerability [CWE-89] in DHIS2, an open-source information system used for data capture, management, validation, analytics, and visualization. The flaw affects DHIS2 SQL View data endpoints, where authenticated users with SQL View access can supply crafted filter values that are interpolated directly into generated SQL statements. An attacker with SQL View execution privileges can manipulate the resulting query and access data beyond the intended SQL View result set.

This issue is tracked separately from CVE-2026-55084, which covers the related SQL View filter column-name injection.

Critical Impact
Authenticated users can escape SQL View result boundaries and read arbitrary database contents, breaking tenant and role-based data isolation in DHIS2 deployments.

Affected Products

DHIS2 2.37 before the 2026-06-09 EOS security update
DHIS2 2.38 before the 2026-06-09 EOS security update
DHIS2 2.39 before the 2026-06-09 EOS security update

Discovery Timeline

2026-07-21 - CVE-2026-55082 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-55082

Vulnerability Analysis

DHIS2 SQL Views let privileged users define parameterized SQL that produces reusable datasets. The affected endpoints accept filter values from the request and merge them into the SQL that DHIS2 generates around the stored view. The value slot is concatenated into the query rather than bound as a parameter, so any SQL metacharacters supplied by the caller become part of the executed statement.

An authenticated caller with SQL View access can therefore break out of the intended value context and append additional clauses. The result is disclosure of rows the SQL View was never designed to return, including data belonging to other organisational units, users, or program stages.

The fix ships in the 2026-06-09 End-of-Support security updates for the 2.37, 2.38, and 2.39 branches. The same value-slot hardening was already present on later supported branches through DHIS2-20174 and Pull Request #22253.

Root Cause

The vulnerability stems from unsafe string interpolation of user-controlled filter values into dynamically generated SQL. The filter path does not use bound parameters, and does not enforce a type-safe allowlist for value tokens before concatenation.

Attack Vector

Exploitation requires a network-reachable DHIS2 instance and an authenticated account with SQL View execution rights. The attacker sends a crafted request to a SQL View data endpoint, embedding SQL fragments in the filter value. See the GitHub Security Advisory GHSA-3288-cm98-664f for technical details.

No verified public exploit code is available. Refer to the vendor advisory
and associated pull requests for the exact vulnerable code paths and the
hardening applied to the SQL View filter value slot.

Detection Methods for CVE-2026-55082

Indicators of Compromise

Requests to DHIS2 SQL View data endpoints containing SQL metacharacters such as single quotes, --, ;, UNION, or SELECT inside filter values.
SQL View responses returning row counts or column shapes that diverge from the view definition.
Database logs showing queries originating from SQL View execution that reference tables not declared in the underlying view.

Detection Strategies

Enable PostgreSQL statement logging for the DHIS2 database and alert on statements executed by the DHIS2 service account that contain UNION SELECT or nested subqueries not present in registered SQL Views.
Inspect DHIS2 audit logs for SQL View executions by accounts that do not normally run analytics workloads.
Correlate authentication events with SQL View endpoint access to identify low-privilege accounts probing filter parameters.

Monitoring Recommendations

Baseline the set of SQL Views executed per role and alert on new or high-frequency executions after the advisory date.
Monitor egress volume from DHIS2 application servers for anomalous bulk responses from /api/sqlViews endpoints.
Forward DHIS2 application and database logs to a centralized analytics platform to enable retrospective hunts across the vulnerable window.

How to Mitigate CVE-2026-55082

Immediate Actions Required

Apply the 2026-06-09 EOS security update for DHIS2 2.37, 2.38, or 2.39, or upgrade to a supported branch that already contains the DHIS2-20174 fix.
Audit which user roles hold F_SQLVIEW_EXECUTE and revoke it from accounts that do not require SQL View execution.
Review recent SQL View executions and database logs for signs of filter-value manipulation.

Patch Information

The vulnerability is patched by the 2026-06-09 EOS security updates for DHIS2 2.37, 2.38, and 2.39. Equivalent value-slot hardening for later branches was delivered through DHIS2-20174. See Pull Request #22253, Pull Request #24172, Pull Request #24173, and Pull Request #24174.

Workarounds

Restrict SQL View execution rights to a minimal set of trusted administrator accounts until the patch is applied.
Place a web application firewall in front of DHIS2 and block filter values containing SQL metacharacters on /api/sqlViews endpoints.
Run the DHIS2 database role with least privilege so that any successful injection cannot reach tables outside the DHIS2 schema.

bash

# Example: identify DHIS2 roles that carry SQL View execution authority
curl -u admin:$DHIS2_PW \
  "https://dhis2.example.org/api/userRoles.json?fields=name,authorities&paging=false" \
  | jq '.userRoles[] | select(.authorities[]? == "F_SQLVIEW_EXECUTE") | .name'