Trigger.dev 4.5.0 and earlier versions allow an attacker to read the delegated user‑actor token that is stored in browser‑readable session input records. By querying the /in records endpoint, the attacker can retrieve the token from the payload.metadata.userActorToken field and use it to gain access to environment JWTs, effectively impersonating the delegated user. This vulnerability results in unauthorized access to workspace data and operations, compromising confidentiality and potentially integrity of the system.

The affected product is trigger.dev, specifically the Dashboard Agent component running versions 4.5.0 through 4.5.x. Users of these versions are at risk if they have deployed the dashboard agent and rely on the session input proxy feature.

The CVSS base score of 5.1 indicates a medium severity. The EPSS score of less than 1% shows that, up to the data cutoff, the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The attack requires possession of a public session token, which can be inferred to be a token that a chat participant can see or otherwise obtain. Once in possession, the attacker can query a documented endpoint to retrieve sensitive information. The exposure is limited to users who have already been granted a session token; without that token the vulnerability is not exploitable.