Executive brief
Midday is a financial management and invoicing platform for freelancers. Any team member, including those with a basic "Member" role (such as invited users), can delete the entire team and all associated records. This includes stored bank connection tokens, which are then used by automated cleanup jobs against external financial service providers, creating a risk of unauthorized transactions or data manipulation at connected banks and payment processors.
Technical details
The vulnerability is an authorization bypass (missing role check) in the team deletion endpoint in apps/api/src/trpc/routers/team.ts. The delete procedure only verifies team access via the team-access helper, which returns true for any team member regardless of role. Unlike neighboring procedures (member remove and member update in the same router) which properly resolve the caller's role and reject non-owner requests, the delete procedure applies no role check. An authenticated team member with "Member" role can invoke the delete operation, removing the team and all scoped records, including bank connection credentials. The cleanup job then executes against external providers using these stored tokens. No patch status is indicated in the advisory; the issue was published on 2026-08-26.
Affected products
- Midday Midday <UNKNOWN>
Timeline
- 2026-08-26: disclosed