Tealium iQ Tag Management CVE-2026-13244

Exploitation requires an authenticated account on the target Drupal site - the CVSS vector specifies PR:L, so a low-privileged (but non-anonymous) user is needed, not an anonymous visitor. The affected site must run the Tealium iQ Tag Management contributed module at a version below 2.4.0. No user interaction is required (UI:N) and the flaw is reachable over the network (AV:N) with low attack complexity (AC:L). The primary limiting factor is the authentication requirement and the need for the specific module to be installed and enabled; scope is unchanged (S:U) and there is no availability impact, so the attack yields data confidentiality/integrity compromise rather than site takedown.

The signals are moderately but not uniformly severe. CVSS 8.1 (High) reflects network attack vector, low complexity, and high confidentiality and integrity impact, but requires low privileges (PR:L), meaning some authenticated access is a prerequisite - this materially limits the exposed attacker population versus a fully unauthenticated flaw. Availability impact is None, so this is a data-compromise issue rather than a denial-of-service one. The EPSS score is low (0.42%, 34th percentile), the vulnerability is not listed in CISA KEV, and no public proof-of-concept is referenced, so real-world exploitation pressure currently appears low. No SSVC decision data was provided. Net assessment: a genuinely high-impact bug worth prompt patching for any site running this module, but not an emergency drive-everything-else priority given the authentication requirement and absence of evidence of exploitation. Note the CVSS vector and description are consistent (network-reachable object injection requiring privileges), so no conflicting signals were identified.

An attacker who holds or obtains a low-privileged authenticated account on a Drupal site running a vulnerable Tealium iQ Tag Management module submits crafted input that manipulates dynamically-determined object attributes (object injection), overwriting object properties or triggering an object-injection gadget to read sensitive data or tamper with application state. Given AV:N/AC:L, the request can be delivered remotely over the network with low complexity. No public proof-of-concept is currently referenced, so exploitation would require the attacker to develop the payload independently.