CVE-2026-114078High· 8.1▾ TwilightTrigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can se…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.
trigger.dev < 4.5.6Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114066High· 8.1Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints
CVE-2026-114068High· 8.3Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint
CVE-2026-114077High· 7.1Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4
CVE-2026-114079Medium· 5.4Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint
CVE-2026-114091Medium· 5.3Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route
CVE-2026-92773High· 7.1Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization