CVE-2026-114067

Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route

State: Published
Severity: 7.1 High
Published: Oct 21, 2026
Updated: Oct 22, 2026
Reserved: Oct 20, 2026

Description

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	VulnCheck

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
trigger.devtriggerdotdev	4.5.0 to before 4.6.2Affected 4.6.2Not affected

References

GitHub Security Advisory (GHSA-pc95-gc74-wg87)vendor-advisory
VulnCheck Advisory: Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Routethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.