4 matches found
CVE-2026-114067
Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...
CVE-2026-114067 Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route
Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...
CVE-2026-114067
Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...
CVE-2026-114067
Versions of Trigger.dev prior to 4.6.2 (specifically 4.5.0 ) are vulnerable to an improper authorization flaw in the PUT snapshot-url session endpoint. The root cause is the absence of a secret-key-only check on this route, which allows public session token holders to obtain presigned S3 write UR...