Midday – Authorization Bypass

On midday, the ‘updateMember’ tRPC mutation allows any authenticated team member to modify the role of any other member within the same team, including promoting themselves to ‘owner’ or demoting existing owners to ‘member’. 

This is due to missing authorization checks that should verify the caller has sufficient privileges (i.e., is an `owner`) before allowing role modifications.

At the time of discovery, owner and member roles did not enforce materially different permissions within Midday, limiting the practical exploitability of this vulnerability.