Live › vulnerability › CVE-2026-114078
Go to dashboardTrigger.dev before 4.5.6 fails to check ownership in the delete and disable schedule services, so a logged-in user can target another organization's schedule by its friendlyId. An attacker can delete or disable other organizations' IMPERATIVE cron schedules, stopping their scheduled tasks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running a Trigger.dev instance before 4.5.6 where more than one organization or tenant has accounts, since the flaw lets an authenticated user act on another organization's schedules. Single-organization deployments with only trusted users are less exposed. The sources do not say which hosted or self-hosted configurations are affected beyond the version.
No product ranges from the sources yet.
4.5.6unknown4.5.6 or later4.5.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.
This page as .md · .json · in your agent: get_signal("CVE-2026-114078")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.