Trigger.dev prior to version 4.5.6 contains an authorization bypass vulnerability in the createDeploymentBackgroundWorkerV4 endpoint. The function resolves a WorkerDeployment by friendlyId alone, ignoring environment, project, or organization scoping. An attacker who has only their own environment API key can POST to this endpoint with a victim's deployment ID, causing the in‑progress deployment to be reassigned to a worker in the attacker's environment. This allows the attacker to hijack the deployment process for another tenant.

The vulnerability is present in triggerdotdev:trigger.dev versions before 4.5.6. No specific sub‑versions are listed; the safe assumption is that any release earlier than 4.5.6 is affected.

The CVSS score of 6.1 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to possess an environment API key, after which they can construct a POST request to the background‑workers endpoint with a victim's deployment ID. The lack of scope checks makes the attack straightforward for anyone with an API key, but they must know or guess a valid deployment ID belonging to another tenant.