The run replay action function in Trigger.dev's webapp (apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts) lacks authentication and authorization checks, unlike the corresponding loader function. The action queries task runs by friendlyId without scoping to the user's organization or verifying user identity, allowing any authenticated user to replay task runs from other organizations. The replayed tasks execute with the victim's environment variables and secrets. A similar authentication omission exists in the batch completion action, allowing unauthorized batch completion triggers. The friendlyId values are short and enumerable, facilitating exploitation. This vulnerability is classified as CWE-862 (Missing Authorization).

An attacker with any valid user session can replay task runs belonging to other organizations, causing execution of tasks in the victim's environment with access to sensitive environment variables such as API keys and database credentials. This leads to secret exposure and unauthorized resource consumption under the victim's quota. Additionally, unauthorized batch completion triggers can disrupt data integrity by prematurely resuming dependent tasks. The vulnerability has low attack complexity due to predictable friendlyId values.

A patch is available for this vulnerability. Users should update to a fixed version at or beyond 4.5.2 where authentication and authorization checks are enforced on the run replay and batch completion actions. Until patched, restrict access to the affected endpoints and monitor for unauthorized task replay or batch completion activity.