CVE-2026-81035
Received Received - Intake

Unauthorized Team Deletion in Midday Application

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the role it records, and the data-layer function it calls re-checks the same helper and nothing else. The neighbouring procedures that remove or update a member in the same router each resolve the caller's role and refuse the request unless it is owner, so the check exists in the file and is not applied to deletion. Member is the role an invited user receives, so any invitee can remove the team and every record scoped to it, and the deletion enqueues the cleanup job with the stored bank-connection tokens, which the job then uses against the connected providers. The update procedure in the same router carries no role check either.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-09-15
AI Q&A
2026-08-26
EPSS Evaluated
2026-09-14
NVD
CVE-2026-81035
EUVD
EUVD-2026-66611

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
midday-ai midday to e5f45ed0d49cdb34576373623c4579b72daa74c1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Midday allows any team member to delete the entire team. The vulnerability exists because the delete function in the code does not properly check the user's role. Instead, it uses a helper that always returns true, allowing any member to delete the team and all associated data. This includes bank connection tokens that are later used by a cleanup job to interact with external providers.

Detection Guidance

This vulnerability is specific to the Midday application and cannot be detected via general network or system commands. Instead, check if your Midday instance is running a vulnerable version by inspecting the commit hash in apps/api/src/trpc/routers/team.ts. If the commit matches e5f45ed0d49cdb34576373623c4579b72daa74c1 or earlier, the application is vulnerable.

Impact Analysis

This vulnerability allows any invited team member to delete the entire team and all its data. This includes financial data linked via bank connections, which could lead to data loss or unauthorized access to sensitive information. The impact includes potential disruption of services and exposure of confidential data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized deletion of data and potential exposure of sensitive information. GDPR requires data integrity and access controls, while HIPAA mandates protection of health-related data. Unauthorized deletion or access could result in violations and legal penalties.

Mitigation Strategies

Update the Midday application to the latest version where the team deletion procedure includes proper role-based authorization checks. Ensure only team owners can delete teams or members.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81035. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart