CVE-2026-92773

Trigger.dev before 4.6.0 GitHub App Installation Takeover

7.1 High

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim's repositories.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: None

Exploit likelihood

0.32%Unchanged since Sep 17, 2026

What each source reports

CVE List Score used 7.1

Trigger.dev before 4.6.0 GitHub App Installation Takeover

Record: CVE-2026-92773
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

EUVDEUVD-2026-81037 7.1

Record: EUVD-2026-81037
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-48fw-mh64-g6wf 7.1

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App...

Record: GHSA-48fw-mh64-g6wf
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

NVD 7.1

Record: CVE-2026-92773
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

OSV 7.1

Trigger.dev before 4.6.0 GitHub App Installation Takeover

Record: CVE-2026-92773
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Weakness: CWE-639
Updated: 2026-11-02

Affected products

triggerdotdev trigger.dev

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-92773 is a high vulnerability (CVSS 7.1) in Triggerdotdev Trigger.dev, published September 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. No source names a fixed version.