CVE-2026-114078
highTrigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticat…
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-h4pj-26m5-j4r3 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.6-cross-organization-schedule-... disclosure@vulncheck.com
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-h4pj-26m5-j4r3 134c704f-9b21-4f2e-91b3-4a467353bcc0