CVE-2026-114075 Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to creat...