EUVD-2026-66611
GHSA-432v-m2wc-4w5v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Any authenticated team member exploits over the network with low complexity (AV:N/AC:L/PR:L); deletion causes high integrity and availability impact with no confidentiality breach and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the role it records, and the data-layer function it calls re-checks the same helper and nothing else. The neighbouring procedures that remove or update a member in the same router each resolve the caller's role and refuse the request unless it is owner, so the check exists in the file and is not applied to deletion. Member is the role an invited user receives, so any invitee can remove the team and every record scoped to it, and the deletion enqueues the cleanup job with the stored bank-connection tokens, which the job then uses against the connected providers. The update procedure in the same router carries no role check either.
AnalysisAI
Team deletion in Midday's tRPC API grants destructive Owner-equivalent authority to any authenticated Member due to a missing role check in apps/api/src/trpc/routers/team.ts. The team-access authorization helper confirms team membership but never validates whether the caller holds the owner role, despite that check being correctly implemented in adjacent member-removal and member-update procedures within the same router. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The caller must be an authenticated Midday user holding any membership in the target team, including the default `Member` role automatically assigned to all invited users - no elevated privilege is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) and score of 7.2 accurately reflect the threat model: network-reachable with low complexity, requiring only low-privilege access (any team membership), producing high integrity and availability impact with no confidentiality component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker invited to a Midday workspace as a standard Member - the default role for any invitee - authenticates to the application and calls the team delete tRPC procedure directly. Because the `team-access` helper confirms membership without verifying the `owner` role, the request succeeds: the team and all associated records are permanently deleted, and the backend enqueues a cleanup job that uses the team's stored bank-connection OAuth tokens against linked financial providers, potentially triggering unintended transactions or token revocation at those providers. |
| Remediation | No vendor-released patch with a confirmed version number was identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately restrict the team deletion API endpoint to Owner-role accounts only via API middleware or gateway; audit all current team member role assignments and remove unnecessary Member-role access; notify all affected Midday teams of the vulnerability and implement operational hold on team deletion until further guidance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today