CVE-2026-114071
CVE-2026-114071 · Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit type=DATETIME or type=MANUAL with isTimeout to prematurely mark the pending waitpoint completed.
CVSS 2.3 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
trigger.dev
- Versions
- ≥ 0, < 4.5.12: Affected (semver)
- 4.5.12: Not affected (semver)
Update to 4.5.12