---
id: CVE-2026-114067
title: >-
  Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session
  Route
summary: >-
  Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization
  vulnerability in the PUT snapshot-url session endpoint that allows public
  session token holders to obtain presigned S3 write URLs. End users can
  overwrite their own sessio…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: triggerdotdev
product: trigger.dev
affected:
  - trigger.dev >= 4.5.0 < 4.6.2
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:36:39.566Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114067'
references:
  - url: >-
      https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pc95-gc74-wg87
    label: GitHub Security Advisory (GHSA-pc95-gc74-wg87)
  - url: >-
      https://www.vulncheck.com/advisories/trigger-dev-4.5.0-before-4.6.2-improper-authorization-via-snapshot-url-session-route
    label: >-
      VulnCheck Advisory: Trigger.dev 4.5.0 before 4.6.2 Improper Authorization
      via snapshot-url Session Route
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.037Z'
---

## Overview

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.

## Affected

- `trigger.dev >= 4.5.0 < 4.6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.