Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: triggerdotdev trigger.dev 4.5.12 Clear all filters
TI-2026-78688 CVE-2026-114075

Authorization bypass in Trigger.dev lets read-only tokens create alert channels

Priority LOW 24

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00311 Published 2026-10-21 Fixed in 4.5.12 CWE-863
TI-2026-78685 CVE-2026-114072

Cross-site request forgery in Trigger.dev Slack OAuth callback

Priority LOW 23

The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00123 Published 2026-10-21 Fixed in 4.5.12 CWE-352
TI-2026-78684 CVE-2026-114071

Trigger.dev lets members complete others' waitpoints early

Priority MEDIUM 45

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment owner…

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.0028 Published 2026-10-21 Fixed in 4.5.12 CWE-862