CVE-2026-55081

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55081", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T14:33:35.711Z", "datePublished": "2026-07-21T18:36:46.507Z", "dateUpdated": "2026-07-22T14:39:07.792Z"}, "containers": {"cna": {"title": "DHIS2 Reflected XSS in OpenAPI HTML scope parameter", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6785-hj47-c27h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6785-hj47-c27h"}, {"name": "https://github.com/dhis2/dhis2-core/pull/24158", "tags": ["x_refsource_MISC"], "url": "https://github.com/dhis2/dhis2-core/pull/24158"}, {"name": "https://github.com/dhis2/dhis2-core/pull/24159", "tags": ["x_refsource_MISC"], "url": "https://github.com/dhis2/dhis2-core/pull/24159"}, {"name": "https://github.com/dhis2/dhis2-core/pull/24160", "tags": ["x_refsource_MISC"], "url": "https://github.com/dhis2/dhis2-core/pull/24160"}, {"name": "https://github.com/dhis2/dhis2-core/pull/24161", "tags": ["x_refsource_MISC"], "url": "https://github.com/dhis2/dhis2-core/pull/24161"}, {"name": "https://github.com/dhis2/dhis2-core/pull/24162", "tags": ["x_refsource_MISC"], "url": "https://github.com/dhis2/dhis2-core/pull/24162"}], "affected": [{"vendor": "dhis2", "product": "dhis2-core", "versions": [{"version": ">= 2.42.0, < 2.42.5.1", "status": "affected"}, {"version": ">= 2.43.0, < 2.43.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-21T18:36:46.507Z"}, "descriptions": [{"lang": "en", "value": "DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value could be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker able to get a user to open a crafted OpenAPI HTML URL could execute JavaScript in that user's browser in the DHIS2 origin.\n\nAffected versions: DHIS2 2.42 and 2.43 before the 2026-06-09 security patch releases, and the development branch for DHIS2 2.44 before the fix was merged.\nPatched in 2.42.5.1, 2.43.0.1, the 2.42 and 2.43 line branches, and the 2.44 development branch."}], "source": {"advisory": "GHSA-6785-hj47-c27h", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T14:38:55.714622Z", "id": "CVE-2026-55081", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T14:39:07.792Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55081", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-22T14:38:55.714622Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T14:39:02.270Z"}}], "cna": {"title": "DHIS2 Reflected XSS in OpenAPI HTML scope parameter", "source": {"advisory": "GHSA-6785-hj47-c27h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "dhis2", "product": "dhis2-core", "versions": [{"status": "affected", "version": ">= 2.42.0, < 2.42.5.1"}, {"status": "affected", "version": ">= 2.43.0, < 2.43.0.1"}]}], "references": [{"url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6785-hj47-c27h", "name": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6785-hj47-c27h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/dhis2/dhis2-core/pull/24158", "name": "https://github.com/dhis2/dhis2-core/pull/24158", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/dhis2/dhis2-core/pull/24159", "name": "https://github.com/dhis2/dhis2-core/pull/24159", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/dhis2/dhis2-core/pull/24160", "name": "https://github.com/dhis2/dhis2-core/pull/24160", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/dhis2/dhis2-core/pull/24161", "name": "https://github.com/dhis2/dhis2-core/pull/24161", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/dhis2/dhis2-core/pull/24162", "name": "https://github.com/dhis2/dhis2-core/pull/24162", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value could be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker able to get a user to open a crafted OpenAPI HTML URL could execute JavaScript in that user's browser in the DHIS2 origin.\n\nAffected versions: DHIS2 2.42 and 2.43 before the 2026-06-09 security patch releases, and the development branch for DHIS2 2.44 before the fix was merged.\nPatched in 2.42.5.1, 2.43.0.1, the 2.42 and 2.43 line branches, and the 2.44 development branch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-21T18:36:46.507Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55081", "state": "PUBLISHED", "dateUpdated": "2026-07-22T14:39:07.792Z", "dateReserved": "2026-06-16T14:33:35.711Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-21T18:36:46.507Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dhis2-core", "vendor": "dhis2", "versions": [{"status": "affected", "version": ">= 2.42.0, < 2.42.5.1"}, {"status": "affected", "version": ">= 2.43.0, < 2.43.0.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value could be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker able to get a user to open a crafted OpenAPI HTML URL could execute JavaScript in that user's browser in the DHIS2 origin.\n\nAffected versions: DHIS2 2.42 and 2.43 before the 2026-06-09 security patch releases, and the development branch for DHIS2 2.44 before the fix was merged.\nPatched in 2.42.5.1, 2.43.0.1, the 2.42 and 2.43 line branches, and the 2.44 development branch."}, {"lang": "es", "value": "DHIS2 es un sistema de informaci\u00f3n flexible para la captura, gesti\u00f3n, validaci\u00f3n, an\u00e1lisis y visualizaci\u00f3n de datos. El endpoint HTML de OpenAPI de DHIS2 reflejaba valores del par\u00e1metro de consulta \u2019scope\u2019 en el documento HTML generado sin una sanitizaci\u00f3n suficiente. Un valor de \u2019scope\u2019 manipulado podr\u00eda ser renderizado como HTML o JavaScript activo en la p\u00e1gina de documentaci\u00f3n de OpenAPI. Un atacante capaz de lograr que un usuario abriera una URL HTML de OpenAPI manipulada podr\u00eda ejecutar JavaScript en el navegador de ese usuario en el origen de DHIS2.\n\nVersiones afectadas: DHIS2 2.42 y 2.43 antes de las versiones del parche de seguridad del 09-06-2026, y la rama de desarrollo para DHIS2 2.44 antes de que se fusionara la correcci\u00f3n.\nParcheado en 2.42.5.1, 2.43.0.1, las ramas de l\u00ednea 2.42 y 2.43, y la rama de desarrollo 2.44."}], "id": "CVE-2026-55081", "lastModified": "2026-10-24T19:10:00.127", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55081", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T14:38:55.714622Z", "version": "2.0.3"}}]}, "published": "2026-07-21T19:17:10.950", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/dhis2/dhis2-core/pull/24158"}, {"source": "security-advisories@github.com", "url": "https://github.com/dhis2/dhis2-core/pull/24159"}, {"source": "security-advisories@github.com", "url": "https://github.com/dhis2/dhis2-core/pull/24160"}, {"source": "security-advisories@github.com", "url": "https://github.com/dhis2/dhis2-core/pull/24161"}, {"source": "security-advisories@github.com", "url": "https://github.com/dhis2/dhis2-core/pull/24162"}, {"source": "security-advisories@github.com", "url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6785-hj47-c27h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.42.0,2.42.5.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.43.0,2.43.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dhis2-core", "source": "cna", "vendor": "dhis2"}, "product": "dhis2-core", "vendor": "dhis2"}], "created": "2026-07-23T21:13:23.265392+00:00", "updated": "2026-07-30T17:00:07.462451+00:00", "vendors": ["dhis2", "dhis2$PRODUCT$dhis2-core"]}