Log in Start free

Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-42202nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

Medium 6.5

In plain English

A medium-severity security flaw in nova-toggle-5 from almirhodzic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 89.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was protected only by web + auth:<guard> middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself (for example, frontend customers sharing the web guard with the Nova admin area). The endpoint also accepted an arbitrary attribute parameter, which meant a valid caller could toggle any boolean column on the underlying model — not just columns exposed as Toggle fields on the resource. This issue has been patched in version 1.3.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistalmirhodzic/nova-toggle-51.3.0GHSA-f5c8-m5vw-rmgq

Affected products (as reported)

VendorProductVersions
almirhodzic nova-toggle-5 < 1.3.0

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References