High
8.1
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in...
CVE-2026-114078
First seen on SecPulse
Original description The description as published by the source.
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.
Source: NIST National Vulnerability Database NVD GitHub Advisory
References
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com