Midday
Monthly
Team deletion in Midday's tRPC API grants destructive Owner-equivalent authority to any authenticated Member due to a missing role check in `apps/api/src/trpc/routers/team.ts`. The `team-access` authorization helper confirms team membership but never validates whether the caller holds the `owner` role, despite that check being correctly implemented in adjacent member-removal and member-update procedures within the same router. Any invited team member - receiving the `Member` role by default - can delete the entire team and all scoped records, and additionally trigger a background cleanup job that exercises stored bank-connection OAuth tokens against connected financial providers. No public exploit identified at time of analysis; no CISA KEV listing.
Team deletion in Midday's tRPC API grants destructive Owner-equivalent authority to any authenticated Member due to a missing role check in `apps/api/src/trpc/routers/team.ts`. The `team-access` authorization helper confirms team membership but never validates whether the caller holds the `owner` role, despite that check being correctly implemented in adjacent member-removal and member-update procedures within the same router. Any invited team member - receiving the `Member` role by default - can delete the entire team and all scoped records, and additionally trigger a background cleanup job that exercises stored bank-connection OAuth tokens against connected financial providers. No public exploit identified at time of analysis; no CISA KEV listing.