{"id":"CVE-2026-114067","summary":"Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route","details":"Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.","aliases":["GHSA-pc95-gc74-wg87"],"modified":"2026-10-23T02:30:43.652688495Z","published":"2026-10-21T00:36:39.566Z","database_specific":{"cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114067.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114067.json"},{"type":"ADVISORY","url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pc95-gc74-wg87"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114067"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/trigger-dev-4.5.0-before-4.6.2-improper-authorization-via-snapshot-url-session-route"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/triggerdotdev/trigger.dev","events":[{"introduced":"86ef3c49799a3de399a0534b5ca7c7244c72caa4"},{"fixed":"6d46534984e9c52b7246af58c6b1ab96609b1e8a"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"4.5.0"},{"fixed":"4.6.2"}],"source":"AFFECTED_FIELD"}]}}],"versions":["docs-release-2026-09-15","v4.6.1","v.docker.4.6.1","helm-v4.6.1","v4.6.0","v.docker.4.6.0","helm-v4.6.0","docs-release-2026-09-14","re2-test-supervisor-run-crd","docs-release-2026-09-08","v4.5.16","v.docker.4.5.16","helm-v4.5.16","docs-release-2026-09-01","v4.5.15","v.docker.4.5.15","helm-v4.5.15","docs-release-2026-08-31","v4.5.14","v.docker.4.5.14","helm-v4.5.14","docs-release-2026-08-28-2","v4.5.13","v.docker.4.5.13","helm-v4.5.13","docs-release-2026-08-28","v4.5.11","v.docker.4.5.11","helm-v4.5.11","v4.5.12","v.docker.4.5.12","helm-v4.5.12","re2-test-supervisor-main-2496a8a8","re2-test-supervisor-2026-08-18","re2-prod-supervisor-2026-08-18","re2-test-supervisor-main-cffaa05","re2-prod-supervisor-cffaa05","re2-test-supervisor-runtime-uid","docs-release-2026-08-17","docs-release-2026-08-13","re2-test-supervisor-main-c526528","re2-prod-supervisor-heatwave-dualwrite","v4.5.10","v.docker.4.5.10","helm-v4.5.10","docs-release-2026-08-07","v4.5.9","v.docker.4.5.9","helm-v4.5.9","v4.5.8","v.docker.4.5.8","helm-v4.5.8","re2-prod-supervisor-dispatch-url","v4.5.7","docs-release-2026-07-23","v.docker.4.5.7","helm-v4.5.7","re2-test-supervisor-enforcement-mode-metric","v4.5.6","v.docker.4.5.6","helm-v4.5.6","re2-test-supervisor-callback-auth-v1","re2-prod-supervisor-callback-auth-v1","v4.5.5","v.docker.4.5.5","helm-v4.5.5","re2-test-supervisor-tri-11473","re2-prod-supervisor-tri-11473","docs-release-20260714-1409","v4.5.4","v.docker.4.5.4","helm-v4.5.4","docs-release-2026-07-14","v4.5.3","v.docker.4.5.3","helm-v4.5.3","v4.5.2","v.docker.4.5.2","helm-v4.5.2","docs-release-2026-07-09","docs-release-20260707-1007","v4.5.1","v.docker.4.5.1","helm-v4.5.1","v4.5.0","v.docker.4.5.0","helm-v4.5.0","docs-release-2026-07-02"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114067.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}