CVE-2026-114078: Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup
Published Oct 21, 2026
·Updated
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.
Affected Software
1 affected component
Trigger.dev Trigger.dev<4.5.6
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trigger.devto a version that resolves this vulnerability.Fixed in 4.5.6
Event History
Oct 21, 2026
CVE Published
via MITRE·12:36 AM
Data Sourced
via MITRE·12:36 AM
DescriptionSeverityWeakness