rootpwn

high · CVSS v3 7.1 · CVSS v4 7.1

CVE-2026-92773

An authorization verification flaw in Trigger.dev prior to version 4.6.0 allows authenticated users to improperly bind GitHub App installati

Overview

An authorization verification flaw in Trigger.dev prior to version 4.6.0 allows authenticated users to improperly bind GitHub App installations to their own organization. By replaying state cookies and manipulating installation identifiers during setup, an attacker can hijack another entity's GitHub App integration. This grants unauthorized access to repositories connected to the targeted installation.

Description

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim's repositories.

Impact

Impacts organizations operating Trigger.dev instances with GitHub App integrations. Successful exploitation leads to compromised confidentiality and integrity by exposing connected GitHub repositories to unauthorized users.

Remediation

Upgrade Trigger.dev instances to version 4.6.0 or later. Audit all current GitHub App installations and linked organization accounts within Trigger.dev to detect and revoke any unauthorized integrations.

Risk context

Evaluated with a High severity rating (CVSS 7.1) and no current EPSS score. Patching should be prioritized for environments relying on GitHub integrations to prevent unauthorized cross-organization access.

Affected products

  • Trigger.dev Trigger.dev (< 4.6.0)

Scores

Severity
high
CVSS v2
5.6
CVSS v3
7.1
CVSS v4
7.1
EPSS
—

Trigger.dev GitHub Integration Authorization Bypass Access Control Patch Management CVE-2026-92773

← All CVEs

Related CVEs

high

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 are vulnerable to a stack-based buffer overflow when parsing Affinity document files. An attacker can craft a malicious file that, when opened, may allow arbitrary code execution on the victim’s machine.

View analysis

high

CVE-2026-92838

A DLL hijacking flaw in GeoVision GV-Remote E-Map allows a local user with write access to a directory to drop a malicious DLL that is loaded before the legitimate one. If exploited, the attacker can run arbitrary code in the context of the GV-Remote E-Map process, potentially compromising local data and system integrity.

View analysis

high

CVE-2026-88765

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a crafted Git export file that triggers arbitrary remote code execution during Advanced Search indexing. The flaw can lead to full server compromise if exploited.

View analysis

high

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis