{"id":"CVE-2026-114078","kind":"vulnerability","aliases":["CVE-2026-114078"],"related":[],"title":"Trigger.dev: authenticated users can delete other organizations' cron schedules","description":"Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.","summary":"Trigger.dev before 4.5.6 fails to check ownership in the delete and disable schedule services, so a logged-in user can target another organization's schedule by its friendlyId. An attacker can delete or disable other organizations' IMPERATIVE cron schedules, stopping their scheduled tasks.","severity":"high","cvss":8.1,"epss":0.003,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multi-tenant","package","self-hosted","trigger.dev"],"not_affected_if":["single-organization","trigger.dev-4.5.6-or-later"],"how_to_check":"- Check the installed Trigger.dev version against `4.5.6`\n- Review self-hosted deployment version with `unknown`","fix":"- Upgrade Trigger.dev to `4.5.6` or later\n- Review schedule deletions and disable actions in audit logs if the version was older than `4.5.6`","status":"open","published_at":"2026-10-21T01:17:32+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:05:57+00:00","updated_at":"2026-10-25T03:05:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:05:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Trigger.dev to `4.5.6` or later\n- Review schedule deletions and disable actions in audit logs if the version was older than `4.5.6`","reach":"internet","title":"Trigger.dev: authenticated users can delete other organizations' cron schedules","impact":"medium","summary":"Trigger.dev before 4.5.6 fails to check ownership in the delete and disable schedule services, so a logged-in user can target another organization's schedule by its friendlyId. An attacker can delete or disable other organizations' IMPERATIVE cron schedules, stopping their scheduled tasks.","category":"package","nicknames":[],"who_cares":["trigger.dev","self-hosted","multi-tenant"],"confidence":0.7,"needs_auth":"yes","worst_case":"Other organizations' cron schedules get deleted or disabled by attackers","analyst_note":"Confirm the affected version range and whether hosted Trigger.dev was patched, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114078.","how_to_check":"- Check the installed Trigger.dev version against `4.5.6`\n- Review self-hosted deployment version with `unknown`","needs_analyst":true,"not_affected_if":["single-organization","trigger.dev-4.5.6-or-later"],"who_is_affected":"Teams running a Trigger.dev instance before 4.5.6 where more than one organization or tenant has accounts, since the flaw lets an authenticated user act on another organization's schedules. Single-organization deployments with only trusted users are less exposed. The sources do not say which hosted or self-hosted configurations are affected beyond the version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":3401,"output_tokens":618,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114078':12A,15A '-2026':11A,14A '4.5.6':26B,70C 'action':97C 'allow':81C 'anoth':46B 'attack':54B,91C 'authent':2A,82C 'author':73C 'bypass':74C 'check':29B 'contain':71C 'cron':8A,62B,115C 'cve':10A,13A 'delet':5A,33B,56B,85C,94C 'deletetaskscheduleservic':77C 'destroy':111C 'disabl':35B,58B,87C,96C 'fail':27B 'friendlyid':52B,109C 'host':22B 'imper':61B,114C 'log':41B 'logged-in':40B 'multi':17B 'multi-ten':16B 'organ':7A,47B,60B,89C,113C 'ownership':30B 'packag':19B 'project':101C 'rout':104C 'schedul':9A,36B,49B,63B,66B,90C,103C,108C,116C 'self':21B 'self-host':20B 'send':93C 'servic':37B 'setactiveontaskscheduleservic':79C 'stop':64B 'target':45B 'task':67B 'tenant':18B 'trigger.dev':1A,23B,24B,68C 'user':3A,43B,83C 'victim':107C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Teams running a Trigger.dev instance before 4.5.6 where more than one organization or tenant has accounts, since the flaw lets an authenticated user act on another organization's schedules. Single-organization deployments with only trusted users are less exposed. The sources do not say which hosted or self-hosted configurations are affected beyond the version.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114078","severity":null,"published_at":"2026-10-21T01:17:32+00:00","modified_at":"2026-10-21T01:17:32+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114078","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114078","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}