Trigger.dev EUVD-2026-107029

Requires a valid authenticated Trigger.dev account with at least one of the attacker's own projects/schedule routes (PR:L), and the attacker must supply a target organization's schedule friendlyId to the delete or disable action - the services resolve that friendlyId without scoping it to the caller's organization. The affected operations specifically target IMPERATIVE cron schedules. Limiting factors: exploitation is bounded to multi-organization deployments of Trigger.dev before 4.5.6, requires authentication (not anonymous), and depends on the attacker knowing or enumerating the victim's schedule friendlyId; impact is limited to destruction/disabling of schedules (integrity/availability) with no data disclosure.

This is a genuine, actionable multi-tenant authorization flaw (CWE-639, IDOR) rather than an inflated high-CVSS issue, though its severity is bounded. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring only a low-privilege authenticated account - any legitimate Trigger.dev user can target other tenants, which is the core concern for a SaaS/self-hosted multi-org platform. Impact is scoped to integrity and availability of scheduling (VI:H/VA:H) with no confidentiality impact (VC:N): the attacker destroys or disables other organizations' cron schedules but does not read their data. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the reporting source is VulnCheck, a credible vulnerability-intelligence vendor, and a GitHub Security Advisory (GHSA-h4pj-26m5-j4r3) exists. The main real-world limiter is that the attacker must know or enumerate a victim organization's schedule friendlyId. Net: a real, patch-worthy tenant-isolation bug for anyone running multi-org Trigger.dev before 4.5.6, but absent EPSS/KEV/POC signals it reads as a targeted-abuse risk rather than an imminent mass-exploitation threat.

An attacker signs up for or already holds a low-privilege account on a shared Trigger.dev instance and creates their own project. Using their own project's schedule route, they submit a delete or disable action referencing another organization's schedule friendlyId, and because DeleteTaskScheduleService and SetActiveOnTaskScheduleService do not scope the lookup to the caller's organization, the victim's IMPERATIVE cron schedules are destroyed or silently disabled, breaking that org's background jobs. No public exploit code was identified in the provided data.