CVE-2026-55082 (GCVE-0-2026-55082)
Vulnerability from cvelistv5
Published
2026-07-21 18:43
Modified
2026-07-22 18:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with access to SQL View execution could manipulate SQL generated for SQL View filters and potentially access data outside the intended SQL View result set.
This is distinct from CVE-2026-55084, which tracks the related SQL View filter column-name injection.
Known affected release lines for this advisory: DHIS2 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates.
Patched by the 2026-06-09 EOS security updates for 2.37, 2.38, and 2.39. The same value-slot hardening was already present on later supported branches through DHIS2-20174 / PR #22253.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| dhis2 | dhis2-core |
Version: = 2.37 Version: = 2.38 Version: = 2.39 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55082",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T18:15:16.949502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T18:26:12.396Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dhis2-core",
"vendor": "dhis2",
"versions": [
{
"status": "affected",
"version": "= 2.37"
},
{
"status": "affected",
"version": "= 2.38"
},
{
"status": "affected",
"version": "= 2.39"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with access to SQL View execution could manipulate SQL generated for SQL View filters and potentially access data outside the intended SQL View result set.\n\nThis is distinct from CVE-2026-55084, which tracks the related SQL View filter column-name injection.\n\nKnown affected release lines for this advisory: DHIS2 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates.\nPatched by the 2026-06-09 EOS security updates for 2.37, 2.38, and 2.39. The same value-slot hardening was already present on later supported branches through DHIS2-20174 / PR #22253."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T18:43:42.535Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3288-cm98-664f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3288-cm98-664f"
},
{
"name": "https://github.com/dhis2/dhis2-core/pull/22253",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dhis2/dhis2-core/pull/22253"
},
{
"name": "https://github.com/dhis2/dhis2-core/pull/24172",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dhis2/dhis2-core/pull/24172"
},
{
"name": "https://github.com/dhis2/dhis2-core/pull/24173",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dhis2/dhis2-core/pull/24173"
},
{
"name": "https://github.com/dhis2/dhis2-core/pull/24174",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dhis2/dhis2-core/pull/24174"
}
],
"source": {
"advisory": "GHSA-3288-cm98-664f",
"discovery": "UNKNOWN"
},
"title": "DHIS2 SQL injection in SQL View filter values"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55082",
"datePublished": "2026-07-21T18:43:42.535Z",
"dateReserved": "2026-06-16T14:33:35.711Z",
"dateUpdated": "2026-07-22T18:26:12.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55082\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-22T18:15:16.949502Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-22T18:15:17.589Z\"}}], \"cna\": {\"title\": \"DHIS2 SQL injection in SQL View filter values\", \"source\": {\"advisory\": \"GHSA-3288-cm98-664f\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"dhis2\", \"product\": \"dhis2-core\", \"versions\": [{\"status\": \"affected\", \"version\": \"= 2.37\"}, {\"status\": \"affected\", \"version\": \"= 2.38\"}, {\"status\": \"affected\", \"version\": \"= 2.39\"}]}], \"references\": [{\"url\": \"https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3288-cm98-664f\", \"name\": \"https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3288-cm98-664f\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/dhis2/dhis2-core/pull/22253\", \"name\": \"https://github.com/dhis2/dhis2-core/pull/22253\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/dhis2/dhis2-core/pull/24172\", \"name\": \"https://github.com/dhis2/dhis2-core/pull/24172\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/dhis2/dhis2-core/pull/24173\", \"name\": \"https://github.com/dhis2/dhis2-core/pull/24173\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/dhis2/dhis2-core/pull/24174\", \"name\": \"https://github.com/dhis2/dhis2-core/pull/24174\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with access to SQL View execution could manipulate SQL generated for SQL View filters and potentially access data outside the intended SQL View result set.\\n\\nThis is distinct from CVE-2026-55084, which tracks the related SQL View filter column-name injection.\\n\\nKnown affected release lines for this advisory: DHIS2 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates.\\nPatched by the 2026-06-09 EOS security updates for 2.37, 2.38, and 2.39. The same value-slot hardening was already present on later supported branches through DHIS2-20174 / PR #22253.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-21T18:43:42.535Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-55082\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-22T18:26:12.396Z\", \"dateReserved\": \"2026-06-16T14:33:35.711Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-21T18:43:42.535Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…