Vulnerability Description
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-h4pj-26m5-
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.6-cross-organization
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-h4pj-26m5-
FAQ
What is CVE-2026-114078?
CVE-2026-114078 is a vulnerability with a CVSS score of 8.1 (HIGH). Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organ...
How severe is CVE-2026-114078?
CVE-2026-114078 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114078?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.