Vulnerability Description
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim's repositories.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/triggerdotdev/trigger.dev
- https://github.com/triggerdotdev/trigger.dev/blob/v4.5.16/apps/webapp/app/servic
- https://github.com/triggerdotdev/trigger.dev/blob/v4.6.0/apps/webapp/app/service
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9rx3-j5hm-
- https://www.vulncheck.com/advisories/trigger-dev-before-4.6.0-github-app-install
FAQ
What is CVE-2026-92773?
CVE-2026-92773 is a vulnerability with a CVSS score of 7.1 (HIGH). Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installati...
How severe is CVE-2026-92773?
CVE-2026-92773 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92773?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.