CVE-2026-13244

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.drupal.org/sa-contrib-2026-064	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dakku:tealium_iq_tag_management:*:*:*:*:*:drupal:*:*

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Modificación Indebidamente Controlada de Atributos de Objeto Determinados Dinámicamente en Drupal Tealium iQ Tag Management permite la inyección de objetos. Este problema afecta a las versiones de Tealium iQ Tag Management: desde la 0.0.0 hasta la 2.4.0.

Information

Published : 2026-07-10 22:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-13244

Mitre link : CVE-2026-13244

CVE.ORG link : CVE-2026-13244

JSON object : View

Products Affected

dakku

tealium_iq_tag_management

CWE

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

{"id": "CVE-2026-13244", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13244", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-13T17:55:08.289819Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "mlhess@drupal.org", "affectedData": [{"repo": "https://git.drupalcode.org/project/tealiumiq", "vendor": "Drupal", "product": "Tealium iQ Tag Management", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.4.0", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/tealiumiq"}]}], "published": "2026-07-10T22:16:40.523", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-064", "tags": ["Vendor Advisory"], "source": "mlhess@drupal.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "mlhess@drupal.org", "description": [{"lang": "en", "value": "CWE-915"}]}], "descriptions": [{"lang": "en", "value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0."}, {"lang": "es", "value": "Vulnerabilidad de Modificaci\u00f3n Indebidamente Controlada de Atributos de Objeto Determinados Din\u00e1micamente en Drupal Tealium iQ Tag Management permite la inyecci\u00f3n de objetos. Este problema afecta a las versiones de Tealium iQ Tag Management: desde la 0.0.0 hasta la 2.4.0."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dakku:tealium_iq_tag_management:*:*:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "3A37E976-383D-4CA0-96EF-B30B6B86F5F2", "versionEndExcluding": "2.4"}], "operator": "OR"}]}], "sourceIdentifier": "mlhess@drupal.org"}