Skip to content
CVE PROGRAM SOURCE RECORD2.3 Low

CVE-2026-114071

Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit type=DATETIME or type=MANUAL with isTimeout to prematurely mark the pending waitpoint completed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

triggerdotdev trigger.dev

Default version status: unaffected

  • 0 to < 4.5.12affected
  • 4.5.12unaffected

References