DHIS2 is a widely used health information system. In this vulnerability, authenticated users with SQL View access can supply crafted filter values. Those values are interpolated directly into the generated SQL query for a SQL View, allowing the attacker to modify the query logic. The result is that the attacker may retrieve information that lies outside the intended result set, effectively exposing sensitive data. This weakness is a classic example of the "SQL Injection" class of vulnerability (CWE-89).

The affected releases are DHIS2 core versions 2.37, 2.38, and 2.39 prior to the 2026‑06‑09 end‑of‑service security update. Versions beyond those releases incorporate hardening (DHIS2‑20174) and are not affected by this specific issue.

The CVSS base score of 8.7 places this flaw in the high severity category, while the EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user with SQL View execution privileges; thus, the likely vector is an attacker who already has legitimate access to the system and uses that access to craft malicious filter values. If exploited, the impact is the unauthorized disclosure of data that the user should not be able to see.