CVE-2026-114075
CVE-2026-114075 · Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to create production webhook channels, routing future deployment and error alerts to attacker-controlled infrastructure.
CVSS 5.3 · Media · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
trigger.dev
- Versiones
- ≥ 0, < 4.5.12: Afectada (semver)
- 4.5.12: No afectada (semver)
Actualiza a 4.5.12