CVE-2026-81035 Overview
CVE-2026-81035 is a broken access control vulnerability in Midday, an open-source financial operations platform. The flaw resides in the team deletion procedure at apps/api/src/trpc/routers/team.ts, where the authorization helper validates only team membership and not the caller's role. Any user invited to a team with the default member role can delete the team and every record scoped to it. The deletion also enqueues a cleanup job that uses stored bank-connection tokens against connected financial providers. The related update procedure in the same router lacks the same role check.
Critical Impact
Any invited team member can destroy team data and trigger downstream cleanup jobs against connected banking providers using stored tokens.
Affected Products
- Midday (midday-ai/midday) API
- apps/api/src/trpc/routers/team.ts team deletion procedure
- apps/api/src/trpc/routers/team.ts team update procedure
Discovery Timeline
- 2026-08-26 - CVE-2026-81035 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-81035
Vulnerability Analysis
The vulnerability is a missing authorization check [CWE-862] in the team management router of Midday. The delete procedure authenticates the caller through a team-access helper that returns true for every row in the team-membership table, regardless of the role recorded. The data-layer function invoked by the procedure re-checks the same helper and performs no additional validation.
Adjacent procedures in the same router, specifically the ones that remove or update a member, resolve the caller's role and reject requests unless the role is owner. The owner check exists in the codebase but is not applied to team deletion or team update. Because member is the default role assigned to invited users, any invitee can invoke deletion and destroy every record scoped to the team.
The deletion path also enqueues a cleanup job carrying the stored bank-connection tokens. That job subsequently uses those tokens against the connected financial providers, extending the blast radius beyond the local database.
Root Cause
The root cause is inconsistent authorization enforcement across sibling tRPC procedures. The team-access helper resolves membership but not role. The delete and update procedures rely on this helper alone, while member-management procedures layer an explicit owner role check on top of it.
Attack Vector
An authenticated user with the member role on any team calls the delete tRPC procedure over the network. The request succeeds, all team-scoped records are removed, and the cleanup job begins operating against connected banking providers using the stored tokens. See the VulnCheck Security Advisory and the affected source file on GitHub for technical details.
Detection Methods for CVE-2026-81035
Indicators of Compromise
- Unexpected team deletion events in Midday application logs originating from accounts holding only the member role.
- Unscheduled cleanup jobs referencing bank-connection tokens after a team delete event.
- Team configuration updates performed by non-owner accounts through the tRPC team.update procedure.
Detection Strategies
- Instrument the team.delete and team.update tRPC handlers to log caller identity, resolved role, and target team ID for every invocation.
- Compare team membership role at the time of deletion against an audit trail to identify calls made by non-owners.
- Alert on cleanup jobs that dispatch requests to bank-connection providers outside expected offboarding workflows.
Monitoring Recommendations
- Forward Midday API and job-runner logs to a centralized analytics pipeline for correlation of delete and update events with the caller's role.
- Monitor outbound API calls from Midday to connected banking providers for unusual disconnect or cleanup traffic.
- Track team membership churn to surface invited members who trigger destructive operations shortly after joining.
How to Mitigate CVE-2026-81035
Immediate Actions Required
- Upgrade Midday to the fixed release once the maintainers publish a patch tied to issue #890.
- Audit existing team memberships and remove any invited accounts that are not required for current operations.
- Rotate bank-connection tokens for any team where an unauthorized deletion or update may have occurred.
Patch Information
At the time of publication, refer to the Midday repository and the tracking GitHub issue for patch status. The fix must add an explicit owner role check to both the delete and update procedures in apps/api/src/trpc/routers/team.ts, matching the enforcement already present on member-management procedures.
Workarounds
- Restrict team invitations to trusted operators until the role check is applied to the deletion and update procedures.
- Apply a local patch that resolves the caller's role and rejects team.delete and team.update invocations unless the role is owner.
- Disable or gate the cleanup job that processes stored bank-connection tokens so that a stray deletion does not propagate to connected providers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
