An authorization bypass in trigger.dev allows authenticated users to manipulate deployments belonging to other projects, leading to potential service disruption or unauthorized state changes.

This vulnerability involves authorization bypass through user-controlled keys (CWE-639) and missing authorization (CWE-862). An authenticated user can supply a different project's deployment ID, allowing them to link their own background workers to a victim's deployment and alter the deployment status.

This flaw allows for unauthorized control over deployment workflows, which could lead to supply chain attacks or the injection of malicious code into production environments. By moving victim deployments from building to deploying, an attacker can effectively hijack the deployment lifecycle, resulting in significant operational risk and potential integrity loss. Given the CVSS score of 9.9, this is a critical security concern.

Immediate Action: Update the trigger.dev platform to version 4.5.6 or later to ensure proper authorization predicates are applied to deployment operations.

Proactive Monitoring: Audit deployment logs for unusual activity, specifically looking for mismatches between API keys used and project identifiers targeted.

Compensating Controls: Enforce strict organizational policies regarding API key management and ensure that only authorized developers have access to CI/CD pipeline triggers.

Public Exploit Available: Unknown

Organizations utilizing trigger.dev must apply the provided patch immediately to close the authorization gap. Because this vulnerability allows users to cross project boundaries, the impact on environment integrity is severe, making rapid remediation essential to maintaining a secure development pipeline.