GHSA-PP95-GC86-JQ6Q Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)

Summary The run replay action function at apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts has no authentication or authorization check. While the loader GET in the same file properly calls requireUserrequest and scopes queries to the user's organizations, the action POST at line 166...