Trigger.dev's replay API endpoint (`POST /api/v1/runs/:runParam/replay`) in versions 4.4.2 through 4.5.0-rc.4 does not properly filter by runtimeEnvironmentId when querying task runs, allowing any valid environment API key to replay runs belonging to other tenants by referencing their friendlyId. This can lead to unauthorized resource consumption and repeated side effects. Furthermore, when the payload type is "application/store", the function overrideExistingPayloadPacket() calls conditionallyImportPacket() on the existing task run's payload without verifying integrity. This allows payload bytes to be overwritten through a separate object-store path traversal vulnerability, enabling attacker-controlled input to be injected into victim tasks. The vulnerability is classified under CWE-22 (Path Traversal), CWE-345 (Insufficient Verification of Data Authenticity), and CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability has a CVSS 3.1 score of 4.2 (medium severity) and is fixed in version 4.5.0-rc.4.

An attacker with any valid environment API key can replay runs belonging to other tenants, causing unauthorized consumption of victim resources and potential repetition of side effects. Additionally, attacker-controlled payload injection is possible via a path traversal vulnerability in the object store, which can compromise the integrity of victim tasks. There is no indication of confidentiality impact, but integrity and availability impacts are present.

A fix is available starting with version 4.5.0-rc.4. Users should upgrade to version 4.5.0-rc.4 or later to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is not yet confirmed beyond the stated fixed version; users should verify with the vendor for current remediation guidance.