---
id: "CVE-2026-114078"
kind: "vulnerability"
aliases: ["CVE-2026-114078"]
title: "Trigger.dev: authenticated users can delete other organizations' cron schedules"
severity: "high"
cvss: 8.1
epss: 0.003
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multi-tenant", "package", "self-hosted", "trigger.dev"]
not_affected_if: ["single-organization", "trigger.dev-4.5.6-or-later"]
published_at: "2026-10-21T01:17:32+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:05:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114078", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114078", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Trigger.dev: authenticated users can delete other organizations' cron schedules

Trigger.dev before 4.5.6 fails to check ownership in the delete and disable schedule services, so a logged-in user can target another organization's schedule by its friendlyId. An attacker can delete or disable other organizations' IMPERATIVE cron schedules, stopping their scheduled tasks.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Trigger.dev version against `4.5.6`
- Review self-hosted deployment version with `unknown`

## Fix

- Upgrade Trigger.dev to `4.5.6` or later
- Review schedule deletions and disable actions in audit logs if the version was older than `4.5.6`

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114078
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114078

## From the sources

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_