CVE-2026-114078

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.6

Description An authorization bypass exists in the DeleteTaskScheduleService and SetActiveOnTaskScheduleService functions. This flaw allows authenticated users to delete or disable schedules belonging to other organizations. An attacker can execute these actions by sending requests through their own project's schedule route using a victim's friendlyId to destroy IMPERATIVE cron schedules (time-based job schedulers).

Recommendations Update to version 4.5.6 or later.