Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 3
https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9fq3-68cw…
disclosure@vulncheck.com
https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pp95-gc86…
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/trigger-dev-before-4.5.0-missing-authentic…
disclosure@vulncheck.com