Trigger.dev versions before 4.5.12 contain a missing authorization check that allows any authenticated project member to complete another member’s development environment waitpoint. By knowing a victim’s waitpoint friendly ID, an attacker can submit a request with type=DATETIME or type=MANUAL and isTimeout set, causing the system to mark the pending waitpoint as completed prematurely. This abuse of the waitpoint completion flow can lead to incorrect project status, disrupt automated workflows, or give a user control over another’s development environment without proper ownership confirmation.

The vulnerability affects the Trigger.dev platform provided by triggerdotdev, specifically all releases prior to version 4.5.12. Users of older Release Candidates or builds that have not applied the official patch are susceptible.

The CVSS base score is 2.3, indicating a low overall severity, and the EPSS score is below 1%, showing limited likelihood of exploitation. The issue is not listed in the CISA KEV catalog, further underscoring its low exploitation probability. The attack vector is an authenticated internal use of the application; an attacker must have valid project credentials and knowledge of the target waitpoint ID, which means the risk is confined to environments with accessible credentials. Given the narrow access and the low severity, monitoring and timely patching are advised rather than immediate action.