CVE-2026-114078

EUVD-2026-107029
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 21.49%
Common Weakness Enumeration
References
https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-h4pj-26m5-j4r3
https://www.vulncheck.com/advisories/trigger-dev-before-4.5.6-cross-organization-schedule-deletion-via-unscoped-friendlyid-lookup