CVE-2026-114071
CVE-2026-114071 · Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit type=DATETIME or type=MANUAL with isTimeout to prematurely mark the pending waitpoint completed.
CVSS 2.3 · Baja · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
trigger.dev
- Versiones
- ≥ 0, < 4.5.12: Afectada (semver)
- 4.5.12: No afectada (semver)
Actualiza a 4.5.12