CVE-2026-13244

Name of the Vulnerable Software and Affected Versions Tealium iQ Tag Management versions 0.0.0 through 2.4.0

Description Improperly controlled modification of dynamically-determined object attributes in the Tealium iQ Tag Management module allows for Object Injection. This occurs because the tealiumiq field stores data as PHP-serialized strings; if malicious data is written to this field, it can be executed when the data is unserialized. Exploitation requires the attacker to have permissions to edit a content entity with an attached tealiumiq field. Additionally, the core jsonapi module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", or the attacker must have an alternative method to edit field values directly.

Recommendations Update Tealium iQ Tag Management to a version later than 2.4.0. Restrict permissions to edit content entities containing the tealiumiq field. Disable the "Accept all JSON:API create, read, update, and delete operations" option in the jsonapi module.