CVE-2026-114071

Versions of Trigger.dev prior to 4.5.12 are vulnerable to an authorization bypass within the waitpoint complete route. The root cause is a failure to perform a per-user environment ownership check, allowing authenticated project members to interact with other members' DEVELOPMENT environment wait...

CVE-2026-114071 Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit...