CVE-2026-13244

Description

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.

PUBLISHED Reserved 2026-06-24 | Published 2026-07-10 | Updated 2026-07-13 | Assigner drupal

Problem types

CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

Product status

Credits

Drew Webber (mcdruid) finder

Benji Fisher (benjifisher) remediation developer

Daniel Schiavone (schiavone) remediation developer

Benji Fisher (benjifisher) coordinator

Bram Driesen (bramdriesen) coordinator

Neil Drumm (drumm) coordinator

Drew Webber (mcdruid) coordinator

Juraj Nemec (poker10) coordinator

References

www.drupal.org/sa-contrib-2026-064

cve.org (CVE-2026-13244)

nvd.nist.gov (CVE-2026-13244)

Download JSON