Trigger.dev before version 4.5.6 suffers from an improper authorization flaw that lets holders of lower‑trust environment API keys cancel deployments in other environments. The flaw occurs because the DeploymentService.getDeployment routine performs a project‑level lookup without checking the environment scope. Consequently, an attacker who possesses a dev, preview, or CI secret key can send a POST request to the deployment cancel endpoint and terminate in‑progress production deployments, breaching confidentiality and availability of deployment processes. The weakness is classified as CWE‑639, an authorization bypass via user‑controlled key.

Affected systems are trigger.dev deployments running any version earlier than 4.5.6. The vendor, triggerdotdev, released a patch in version 4.5.6 that closes the authorization gap. Systems using older releases should upgrade to this or later releases to prevent the exploit.

The CVSS score of 5.3 indicates moderate severity; the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need valid lower‑trust environment API credentials and the ability to perform authenticated POST calls. Since the flaw grants cancellation rights across environments within the same project, the attack vector relies on existing API key access. The exploit is straightforward if users inadvertently grant developers broader permissions, so mitigating the issue promptly is recommended.