---
id: CVE-2026-114078
title: >-
  Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped
  friendlyId Lookup
summary: >-
  Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in
  DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows
  authenticated users to delete or disable other organizations' schedules.
  Attackers can se…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-639
vendor: triggerdotdev
product: trigger.dev
affected:
  - trigger.dev < 4.5.6
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:36:47.218Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114078'
references:
  - url: >-
      https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-h4pj-26m5-j4r3
    label: GitHub Security Advisory (GHSA-h4pj-26m5-j4r3)
  - url: >-
      https://www.vulncheck.com/advisories/trigger-dev-before-4.5.6-cross-organization-schedule-deletion-via-unscoped-friendlyid-lookup
    label: >-
      VulnCheck Advisory: Trigger.dev before 4.5.6 Cross-Organization Schedule
      Deletion via Unscoped friendlyId Lookup
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.024Z'
---

## Overview

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.

## Affected

- `trigger.dev < 4.5.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.