CVE-2026-81035: Missing Authorization in midday-ai midday

CVE-2026-81035 describes a missing authorization control in the midday-ai midday product. Specifically, the delete procedure in the team router authorizes callers using a team-access helper that returns true for all team members regardless of their role. Unlike neighboring update or remove member procedures that enforce owner-only restrictions, the delete function does not check the caller's role beyond membership. Consequently, any invited user with the member role can delete the entire team and all scoped records. The deletion also triggers a cleanup job that uses stored bank-connection tokens against connected providers. No remediation level or patch information is provided in the vendor data.

Any team member, including invited users with the lowest member role, can delete the entire team and all associated data records. This unauthorized deletion could lead to data loss and disruption of services relying on the team data. Additionally, the cleanup job triggered by deletion uses stored bank-connection tokens, potentially impacting connected financial providers or services. The vulnerability has a high CVSS 4.0 score of 7.2, indicating significant impact due to network attack vector, low attack complexity, no privileges required, and high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict team membership to trusted users only and monitor for unauthorized deletion attempts. Avoid inviting users with minimal roles to sensitive teams. Implement additional access controls or compensating controls if possible to prevent unauthorized deletions.