---
id: "CVE-2026-114071"
kind: "vulnerability"
aliases: ["CVE-2026-114071"]
title: "Trigger.dev: authorization bypass lets members complete others' dev waitpoints"
severity: "low"
cvss: 3.1
epss: 0.00202
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multi-user-projects", "package", "self-hosted", "trigger.dev"]
not_affected_if: ["single-user-project", "version-4.5.12-or-later"]
published_at: "2026-10-21T01:17:30+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T04:47:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114071", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114071", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Trigger.dev: authorization bypass lets members complete others' dev waitpoints

Trigger.dev before 4.5.12 skips a per-user environment ownership check on waitpoints. An authenticated project member who knows a victim's waitpoint friendly ID can mark that pending DEVELOPMENT waitpoint completed early.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Trigger.dev version in the project's package.json or deployment image, for example `npm ls @trigger.dev/sdk` or the server image tag.
- unknown for any other check, the sources do not say.

## Fix

- Upgrade Trigger.dev to `4.5.12` or later.
- unknown for any workaround, the sources do not say.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114071
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114071

## From the sources

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit type=DATETIME or type=MANUAL with isTimeout to prematurely mark the pending waitpoint completed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_