Description (CNA)
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit type=DATETIME or type=MANUAL with isTimeout to prematurely mark the pending waitpoint completed.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| triggerdotdev / trigger.dev | affected 0 before 4.5.12; unaffected 4.5.12 |
CWE
CWE-862