CVE-2026-114075

Versions of Trigger.dev before 4.5.12 are vulnerable to an authorization bypass (CWE-863) via the Alert Channels API . This flaw allows holders of capability-restricted user-actor tokens to utilize the legacy personal access token helper to create alert channels. Specifically, an attacker with a ...