CVE-2026-114078

Deferred Deferred - Pending Action

Authorization Bypass in Trigger.dev Allows Schedule Manipulation

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulnCheck

Description

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114078

EUVD

EUVD-2026-107029

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-114078 is a high-severity authorization bypass vulnerability in Trigger.dev versions before 4.5.6. It allows authenticated users to delete or disable imperative cron schedules belonging to other organizations by exploiting unscoped friendlyId lookups in DeleteTaskScheduleService and SetActiveOnTaskScheduleService. Attackers send delete or disable requests with a victim's schedule friendlyId through their own project's schedule route, bypassing proper authorization checks.

Detection Guidance

Check Trigger.dev version with npm list trigger.dev or grep package.json. Inspect logs for unauthorized schedule deletions or modifications in DeleteTaskScheduleService and SetActiveOnTaskScheduleService. Monitor for suspicious API calls to /schedules routes with cross-organization friendlyId parameters.

Impact Analysis

If you use Trigger.dev versions before 4.5.6, an attacker with dashboard access could delete or disable your organization's imperative cron schedules. This could disrupt scheduled tasks, cause data loss, or lead to service outages. The impact depends on whether your organization relies on these schedules for critical operations.

Compliance Impact

This vulnerability could impact compliance by disrupting data processing workflows that rely on scheduled tasks. For GDPR, it may affect data integrity and availability requirements. For HIPAA, it could interfere with scheduled data backups or processing tasks. Organizations must ensure their systems remain operational to meet regulatory obligations.

Mitigation Strategies

Upgrade Trigger.dev to version 4.5.6 or higher immediately. Review and revoke any unauthorized schedule changes. Audit all imperative schedules for integrity. Implement strict input validation for friendlyId parameters in schedule routes.

Hi! I’m here to help you understand CVE-2026-114078. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...