Vulnerability details

CVE-2026-92773

triggerdotdev trigger.dev

Trigger.dev before 4.6.0 GitHub App Installation Takeover

CVSS 4.0

7.1High

Official description

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim's repositories.

CVSS scores

Score	Version	Source	Vector
7.1High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N`
7.1High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N`

Affected products

Vendor	Product	Versions	Source
triggerdotdev	trigger.dev	v < 4.6.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9rx3-j5hm-5f27 third-party-advisoryvendor-advisory
https://github.com/triggerdotdev/trigger.dev/blob/v4.5.16/apps/webapp/app/services/gitHub.server.ts technical-description
https://github.com/triggerdotdev/trigger.dev/blob/v4.6.0/apps/webapp/app/services/gitHub.server.ts#L83-L86 patch
https://github.com/triggerdotdev/trigger.dev product
https://www.vulncheck.com/advisories/trigger-dev-before-4.6.0-github-app-installation-takeover third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-17
Last updated: 2026-09-17
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.32%

Probability of exploitation in 30 days

25.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-639
Authorization Bypass Through User-Controlled Key