Login Request a demo
High severity · published Sep 16, 2026
CVE-2026-92773
Trigger.dev before 4.6.0 GitHub App Installation Takeover
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim's repositories.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
trigger.dev · triggerdotdev
before 4.6.0 · source: vendor
Affected product
TR
trigger.dev
triggerdotdev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92773
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92773
github.com
https://github.com/triggerdotdev/trigger.dev
github.com
https://github.com/triggerdotdev/trigger.dev/blob/v4.5.16/apps/webapp/app/services/gitHub.server.ts
github.com
https://github.com/triggerdotdev/trigger.dev/blob/v4.6.0/apps/webapp/app/services/gitHub.server.ts#L83-L86
github.com
https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9rx3-j5hm-5f27
www.vulncheck.com
https://www.vulncheck.com/advisories/trigger-dev-before-4.6.0-github-app-installation-takeover
More from trigger.dev
9.9
CVE-2026-73656
Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
8.8
CVE-2026-114089
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
8.5
CVE-2026-85651
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
8.5
CVE-2026-73654
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
8.3
CVE-2026-114068
Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint