What is the CVSS score of CVE-2026-13244?

CVE-2026-13244 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Tealium iQ Tag Management are affected by CVE-2026-13244?

The Drupal Tealium iQ Tag Management module (versions before 2.4.0) contains an object injection vulnerability (CVSS 8.1) that allows authenticated users to manipulate data attributes, compromising…. A patch is available.

How to fix or mitigate CVE-2026-13244?

Within 24 hours, identify all Drupal instances using the Tealium iQ Tag Management module and verify the current version; prioritize instances handling sensitive customer or business analytics data. Within 7 days, apply the vendor-released patch to upgrade all affected installations to version 2.4.0 or later, documented in Drupal advisory SA-CONTRIB-2026-064. Within 30 days, conduct post-patch verification testing, review authentication logs for suspicious activity during the vulnerability window, and establish a process to monitor Drupal contributed module security advisories to prevent similar exposure gaps.

Tealium iQ Tag Management CVE-2026-13244

EUVD-2026-43068 HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-07-10 drupal

GHSA-7cjh-fc62-8rrg

Code Injection Drupal Tealium Iq Tag Management

8.1

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable object injection needs a low-privileged authenticated account (PR:L), no interaction, yielding high confidentiality and integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 13, 2026 - 19:31 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 13, 2026 - 19:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 13, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jul 13, 2026 - 19:22 NVD

7.3 (HIGH) 8.1 (HIGH)

Analysis Generated

Jul 13, 2026 - 19:07 vuln.today

CVSS changed

Jul 13, 2026 - 19:07 NVD

7.3 (HIGH)

Patch available

Jul 10, 2026 - 23:02 EUVD

CVE Published

Jul 10, 2026 - 21:46 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 10, 2026 - 21:46 cve.org

HIGH 7.3

DescriptionCVE.org

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.

AnalysisAI

Object injection in the Drupal Tealium iQ Tag Management contributed module (versions before 2.4.0) lets authenticated attackers manipulate dynamically-determined object attributes to compromise data confidentiality and integrity. Because the CVSS vector (AV:N/AC:L/PR:L) indicates a low-privileged authenticated user over the network, any user with a foothold on the site can potentially abuse the flaw; there is no public exploit identified at time of analysis and the EPSS probability is low (0.42%). Drupal has published advisory SA-CONTRIB-2026-064 and released a fixed version.

Technical ContextAI

Tealium iQ Tag Management is a Drupal contributed module that integrates the Tealium iQ enterprise tag-management platform (used to deploy marketing/analytics JavaScript tags) into Drupal sites. The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), commonly known as object injection or mass-assignment/property-oriented injection. This class of flaw occurs when untrusted input is used to set or overwrite object properties or is deserialized into a PHP object without restricting which attributes can be modified, allowing an attacker to influence application state, inject unexpected object properties, or trigger PHP object-injection gadget chains. The CPE cpe:2.3:a:drupal:tealium_iq_tag_management confirms the affected component is the Drupal application-layer module rather than the Tealium SaaS platform itself.

RemediationAI

Upgrade the Tealium iQ Tag Management module to version 2.4.0 or later, which is the first release outside the affected range and corresponds to the vendor's patch (Patch: Available from vendor; Drupal advisory SA-CONTRIB-2026-064 at https://www.drupal.org/sa-contrib-2026-064). This is the primary and recommended fix. If you cannot upgrade immediately, reduce exposure by tightening the Drupal permission model so that only fully trusted roles can reach the module's functionality - since exploitation requires an authenticated low-privileged account (PR:L), removing or restricting the relevant module permissions and auditing/limiting account creation and untrusted user roles meaningfully shrinks the attack surface, at the cost of restricting legitimate tag-management workflows. As a further compensating control, place the affected admin/configuration endpoints behind additional access controls (e.g., IP allowlisting or a VPN for the Drupal admin area) and review logs for anomalous submissions to the module's forms; note this may inconvenience remote administrators. Uninstalling the module entirely is the most complete mitigation if the Tealium integration is not in active use.