Trigger.dev before version 4.5.0 performs no authentication or organization check for the dashboard run replay action, which looks up a run by its friendlyId alone. An attacker who can obtain a victim’s friendlyId can send a replay request that causes the original task to be re‑executed with the victim’s secrets and payload. The attacker can therefore expose confidential data or execute arbitrary code in the context of the task, effectively compromising the victim’s environment. The weakness is a classic example of improper authorization (CWE‑306).

The flaw affects all installations of Trigger.dev from vendor triggerdotdev that are using any version earlier than 4.5.0. No information is provided for specific sub‑versions, so any build before 4.5.0 is considered vulnerable.

The CVSS score of 8.3 signals high severity, but the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalogue, indicating that exploitation is currently low probability. The attack vector requires the attacker to know a friendlyId, which is not publicly disclosed or easily guessable—so the attack likely occurs by remote HTTP request to the dashboard portal. However, if the dashboard is exposed to the Internet, the lack of authentication raises the practical risk of unauthorized replay. The low EPSS combined with a high CVSS suggests that while the vulnerability is serious, it may not be widely exploited yet but should still be addressed promptly.