Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81035— Midday Missing Owner Check on Team Deletion

Quick assessment

Affected
midday-ai midday
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Midday 允许团队中的任何成员删除该团队。在 中的删除过程使用“team-access”辅助函数来授权调用者；该函数会遍历团队会员表中的所有记录并一律返回 true，而不论其中记录的角色为何；同时，它调用的数据层函数仅重新检查了这个辅助函数，没有进行其他校验。 同一路由器中相邻的“移除成员”或“更新成员”过程都会解析调用者的角色，并且只有在角色为 owner 时才会允许请求通过，说明角色检查机制本身是存在的，只是未在删除过程中应用。Member 是受邀用户所获得的角色，因此任何受邀者都可以删除整个团队及所有与团

CVSS 8.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
midday-ai midday e5f45ed0d49cdb34576373623c4579b72daa74c1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81035

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Midday Missing Owner Check on Team Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the role it records, and the data-layer function it calls re-checks the same helper and nothing else. The neighbouring procedures that remove or update a member in the same router each resolve the caller's role and refuse the request unless it is owner, so the check exists in the file and is not applied to deletion. Member is the role an invited user receives, so any invitee can remove the team and every record scoped to it, and the deletion enqueues the cleanup job with the stored bank-connection tokens, which the job then uses against the connected providers. The update procedure in the same router carries no role check either.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
midday-ai midday e5f45ed0d49cdb34576373623c4579b72daa74c1 -

II. Public POCs for CVE-2026-81035

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 6226 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-81035

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-81035 (1)

Proof of Concept for CVE-2026-81035 (1)

Vendor Pages for CVE-2026-81035 (1)

Other References for CVE-2026-81035 (1)

IV. Related Vulnerabilities

Same weakness: CWE-862

V. Comments for CVE-2026-81035

No comments yet

Leave a comment