---
id: CVE-2026-114075
title: Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API
summary: >-
  Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that
  allows holders of capability-restricted user-actor tokens to create alert
  channels by using the legacy personal access token helper. Attackers with a
  read-only…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: triggerdotdev
product: trigger.dev
affected:
  - trigger.dev < 4.5.12
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:36:45.162Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114075'
references:
  - url: >-
      https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-wpjq-q67r-pg6m
    label: GitHub Security Advisory (GHSA-wpjq-q67r-pg6m)
  - url: >-
      https://www.vulncheck.com/advisories/trigger-dev-before-4.5.12-authorization-bypass-via-alert-channels-api
    label: >-
      VulnCheck Advisory: Trigger.dev before 4.5.12 Authorization Bypass via
      Alert Channels API
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.025Z'
---

## Overview

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to create production webhook channels, routing future deployment and error alerts to attacker-controlled infrastructure.

## Affected

- `trigger.dev < 4.5.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.