CVE-2026-114078
CVE-2026-114078 · Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.
CVSS 7.2 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
trigger.dev
- Versions
- ≥ 0, < 4.5.6: Affected (semver)
- 4.5.6: Not affected (semver)
Update to 4.5.6