CVE-2026-114071

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.12

Description An authorization bypass allows authenticated project members to complete a waitpoint in another member's DEVELOPMENT environment by skipping the per-user environment ownership check. An attacker with knowledge of a victim's waitpoint friendly ID can submit type=DATETIME or type=MANUAL with isTimeout to prematurely mark a pending waitpoint as completed.

Recommendations Update to version 4.5.12 or later.