The vulnerability allows an authenticated attacker who already has access to Trigger.dev to replay task runs in any environment the attacker does not belong to. By forcing the system to execute these injected runs, the attacker can consume computational resources, potentially incur costs, and taint the run history for the target organization. The flaw arises from missing authorization checks (CWE-862) that should verify environment membership before accepting a replay request.

The flaw affects all instances of Trigger.dev running any version before 4.5.2. The official vendor is triggerdotdev; affected products are the Trigger.dev core platform and related tooling that implements the run replay feature.

The CVSS score of 8.4 indicates a high severity flaw. Although there is no EPSS score provided and the vulnerability is not listed in CISA KEV catalog, the requirement for an authenticated attacker still makes exploitation feasible. Attackers only need valid credentials within their own organization to trigger the replay into other environments. The lack of a rigorous way to verify environment membership during replay operations makes the vulnerability straightforward to exploit for any user with appropriate privileges. Given the high CVSS and the public disclosure, administrators should consider this a critical security concern.