CVE-2026-55082 is an SQL injection vulnerability in the DHIS2-core product affecting versions 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates. The flaw arises because the SQL View data endpoints allow authenticated users with SQL View execution rights to supply crafted filter values that are directly interpolated into generated SQL statements without proper neutralization. This improper neutralization of special elements in SQL commands (CWE-89) could allow these users to manipulate the SQL query and potentially access data outside the intended SQL View result set. The vulnerability is distinct from CVE-2026-55084, which involves injection in filter column names. The vendor released patches as part of the 2026-06-09 EOS security updates for the affected versions, and later branches have the fix integrated via DHIS2-20174 / PR #22253.

An authenticated user with SQL View execution privileges can exploit this vulnerability to manipulate SQL queries by injecting crafted filter values. This could lead to unauthorized access to data beyond what the SQL View is intended to expose, potentially compromising data confidentiality within the DHIS2 system.

The vulnerability is patched by the 2026-06-09 EOS security updates for DHIS2-core versions 2.37, 2.38, and 2.39. Users running these versions should apply these official security updates immediately. Later supported branches already include the necessary fixes. No additional mitigation steps are indicated beyond applying the vendor-provided patches.