NPM: Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)

NPM: Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution IDOR vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.1...

Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)

Summary The run replay action function at apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts has no authentication or authorization check. While the loader GET in the same file properly calls requireUserrequest and scopes queries to the user's organizations, the action POST at line 166...