Midday's API allows any member of a team to delete the team because the delete procedure uses a team‑access helper that grants permission to all rows in the team‑membership table, ignoring the role stored for each member. The cleanup job enqueued by the delete action uses stored bank‑connection tokens to contact connected providers, which means a malicious member could remove the team, erase all scoped data, and trigger credential‑bearing jobs that may expose third‑party access credentials. This flaw enables the complete loss of a team’s data and the potential exfiltration or misuse of provider tokens. While the other team operations in the same router enforce an owner check, that safeguard is absent from the deletion path, creating a direct path for unauthorized removal.

The vulnerability exists in Midday AI's Midday application. No specific version information is disclosed, implying that all current releases of the application are vulnerable until a fix is applied. The issue affects the team management endpoints found in apps/api/src/trpc/routers/team.ts and any deployment that relies on that code path.

The CVSS score of 7.2 indicates a high‑risk vulnerability, and although the EPSS score is not available, the lack of an explicit role check means the attack can be carried out by any team member with API access. The flaw is not listed in the CISA KEV catalog, but the potential for data loss and credential leakage makes it a significant risk. The attack vector is inferred to be remote, performed via the API by any authenticated team member. No special conditions are required beyond membership, so the exploitability is straightforward and the impact on confidentiality, integrity, and availability is extensive.