Trigger.dev releases older than 4.7.0 contain a missing authorization check that lets anyone holding an unrestricted environment API key supply a foreign parentRunId to the batch creation endpoints. By doing so the attacker can suspend, forever block, or force errors into runs that belong to other users or organizations. The weakness is a classic authorization bypass, classified as CWE-639.

The affected product is Trigger.dev from triggerdotdev. All versions prior to 4.7.0 are vulnerable. This includes every release through 4.6.x, regardless of minor patch level.

The CVSS score of 7.2 indicates a moderate to high severity, yet the EPSS score of less than 1% suggests that exploitation attempts are expected to be rare. The vulnerability is not listed in the CISA KEV catalog, meaning no known large‑scale exploitation is documented. Attack feasibility requires possession of an unrestricted environment API key and the ability to craft requests to POST /api/v3/batches or POST /api/v2/tasks/batch with the resumeParentOnCompletion flag. Once these prerequisites are met, the attacker can exercise the denial of service effect without interactive user involvement.