CVE-2026-55081 Details

A reflected cross-site scripting vulnerability has been identified in the DHIS2 OpenAPI HTML endpoint. Affected versions include DHIS2 2.42 and 2.43 prior to the 2026-06-09 security patch releases, as well as the development branch for DHIS2 2.44 before the fix was merged. The vulnerability arises because the endpoint reflected values from the 'scope' query parameter into the generated HTML document without adequate sanitization. This lack of proper input handling allowed a crafted 'scope' value to be rendered as active HTML or JavaScript on the OpenAPI documentation page. As a result, an attacker could potentially execute JavaScript in the context of the user's browser within the DHIS2 origin by getting them to open a specially crafted OpenAPI HTML URL.

Users are advised to upgrade to DHIS2 versions 2.42.5.1, 2.43.0.1, or the 2.44 development branch after the fix was applied. The patched versions sanitize the 'scope' input before it is rendered in the OpenAPI HTML document.