Trigger.dev prior to version 4.5.6 contains an authorization bypass in DeleteTaskScheduleService and SetActiveOnTaskScheduleService. The flaw allows an authenticated user to supply any schedule friendlyId and delete or disable a schedule that belongs to a different organization. This can result in the loss or disruption of scheduled tasks, affecting the victim’s operational processes. The weakness is a classic case of missing authorization controls (CWE‑639).

The affected product is trigger.dev, provided by triggerdotdev, for all releases before 4.5.6. Any deployment of this service on a user’s environment that has not yet applied the patch is vulnerable. The vulnerability is not limited to a specific sub‑product; it impacts all scope of schedule services exposed by the platform.

According to the CVSS base score of 7.2, this flaw is considered high severity. The EPSS score of less than 1% indicates that widespread exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Attackers still need valid authentication to an organization they own, but the service’s unscoped friendlyId lookup makes the exploit trivial once authenticated. Once the call is made, the attacker can drop or disable another organization’s imperative cron schedules, providing a clear path to deny scheduled operations. The denial of critical scheduled tasks may have significant business impact in affected environments.