CVE-2026-55084 dhis2 CVE debrief

Who should care

Organizations using DHIS2, particularly those with sensitive data, should prioritize patching this vulnerability to prevent potential database content extraction by attackers. Affected operators, platforms, and security teams should review the vulnerability and implement necessary mitigations. Vulnerability management and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be checked for extra review. Asset inventory and rollback/change windows should be considered for exposed systems. Source tracking should be implemented to verify the vulnerability and its mitigation. The SqlView API endpoint is used by the `/api/sqlViews/{viewId}/data.json` endpoint, and access to it should be restricted to prevent potential attacks. Additional security measures should be considered to protect against SQL injection attacks. The vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection. The CVE record was published on 2026-07-23T18:24:12.000Z and has not been modified since then. The vulnerability was fixed in PR #24162. SSVCv2/E:N/A:N/T:T/2026-07-22T15:52:51Z/ The CVSS score is 8.8 and the CVSS severity is HIGH. The NVD and CVE.org records should be reviewed for additional information. The source item URL should be reviewed for additional context. References should be reviewed for additional information. The debrief and technical summary should be reviewed for additional context. Evidence notes should be reviewed for source grounding, evidence limits, known and unknown affected scope, and what defenders should verify. The `

Technical summary

A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection.

Defensive priority

Organizations using DHIS2 should prioritize patching this vulnerability to prevent potential database content extraction by attackers.

Recommended defensive actions

• Apply the patch from PR #24162
• Restrict access to the SqlView API endpoint
• Monitor for suspicious activity on the `/api/sqlViews/{viewId}/data.json` endpoint
• Consider implementing additional security measures to protect against SQL injection attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message.

Official resources