vulnerability · Fri 02 Oct 2026 · 22:35 UTC
GHSA-pp95-gc86-jq6q: Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
Filed UTCSource GTH ↗
The run replay action function at apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts has no authentication or authorization check. While the loader (GET) in the same file properly calls requireUser(request) and scopes queries to the user's organizations, the action (POST) at line 166 does neither — allowing any authenticated user to replay task runs from any organization by knowing the run's friendlyId. …
Signals
as the pipeline stamped them- High
- High-risk vulnerability — CVSS 7.1
Indicators
checking abuse.ch ThreatFoxChecking indicators against ThreatFox…
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.