Authorization Bypass in Trigger.dev Waitpoint Completion

Executive Summary

Trigger.dev before version 4.5.12 has an authorization bypass flaw. Authenticated project members can prematurely complete another member's DEVELOPMENT environment waitpoint by skipping a required ownership check. Attackers need to know the victim's waitpoint friendly ID and submit specific request types (DATETIME or MANUAL with isTimeout) to mark the waitpoint as completed without proper authorization.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Trigger.dev instances running versions before 4.5.12. Monitor logs for unauthorized waitpoint completion events where type=DATETIME or type=MANUAL with isTimeout is used by non-owner members. Look for suspicious activity in DEVELOPMENT environments where waitpoint status changes from PENDING to COMPLETED without proper authorization.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to change the status of another user's pending waitpoint to completed. While it does not enable session theft or cross-tenant access, it could disrupt workflows by prematurely advancing tasks in a DEVELOPMENT environment. The impact is limited to modifying waitpoint status and does not expose sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it involves an authorization bypass within a development tool rather than unauthorized data access or exposure. The issue allows premature waitpoint completion but does not enable data breaches or unauthorized access to sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Trigger.dev to version 4.5.12 or later to address the authorization bypass. Ensure environment ownership checks are enforced before waitpoint completion logic executes. Review and audit waitpoint completion logs for any unauthorized changes.

Useful 0 Not Useful 0