CVE-2026-92773 is an authorization bypass vulnerability in trigger.dev prior to version 4.6.0. The issue arises because the application fails to verify ownership of a GitHub App installation when binding it to an organization. Attackers can exploit this by replaying state cookies and supplying sequential installation IDs to impersonate other users' GitHub App installations, thereby accessing repositories without proper authorization.

Successful exploitation allows an attacker with low privileges to gain unauthorized access to repositories belonging to other users by hijacking their GitHub App installations. This could lead to unauthorized repository access, potentially exposing sensitive code or data. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity), indicating significant impact but requiring some attack complexity and partial user interaction.

Upgrade trigger.dev to version 4.6.0 or later, where this authorization verification issue has been fixed. Since this is a self-hosted product, users must apply the official patch or update to the fixed version to remediate the vulnerability. Patch status is confirmed by the affectedVersions field indicating versions prior to 4.6.0 are vulnerable.