DHIS2 allows authenticated users who have access to a SqlView to inject arbitrary SQL into the filter parameter of the /api/sqlViews/{viewId}/data.json endpoint; the injected query is executed by PostgreSQL and the resulting data is reflected in an error message, enabling the attacker to read any data present in the database. This vulnerability is an instance of CWE‑89, which can lead to the disclosure of confidential information without privilege escalation.

The vulnerability affects the DHIS2 Core application (dhis2:dhis2-core) across several major releases: 2.37, 2.38, 2.39, all 2.40.x versions before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, and the 2.44 development branch before PR #24162. Patched versions include 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, and the updated 2.44 development branch.

With a CVSS score of 8.8 the vulnerability is considered high severity; however, the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and it is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user who can view a SqlView and does not involve privilege escalation, so the threat is limited to users with such permissions. The attack is likely to originate from users who have legitimate access and can inject a malicious SQL payload through the filter parameter, resulting in unauthorized data disclosure.