CVE-2026-42202 Details
Description
nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was protected only by web + auth:<guard> middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself (for example, frontend customers sharing the web guard with the Nova admin area). The endpoint also accepted an arbitrary attribute parameter, which meant a valid caller could toggle any boolean column on the underlying model — not just columns exposed as Toggle fields on the resource. This issue has been patched in version 1.3.0.
A vulnerability in Almirhodzic Nova Toggle 5 prior to version 1.3.0 allowed users to improperly modify boolean attributes through the toggle endpoint. This endpoint was only protected by web and authentication middleware, enabling any authenticated user to flip boolean values on any Nova resource. Notably, this included users without access to Nova, such as frontend customers sharing the web guard with the Nova admin area. Additionally, the endpoint accepted an arbitrary attribute parameter, allowing toggling of any boolean column on the underlying model, not just those exposed as Toggle fields.
Users can upgrade to Nova Toggle 5 version 1.3.0, which addresses the vulnerability by implementing proper authorization checks. For those unable to upgrade immediately, the package can be removed or access to the toggle endpoint can be restricted using middleware that enforces the viewNova gate.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/almirhodzic/nova-toggle-5/releases/tag/v1.3.0 | [email protected] | Release NotesVendor |
| https://github.com/almirhodzic/nova-toggle-5/security/advisories/GHSA-f5c8-m5vw-rmgq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| almirhodzic nova-toggle-5 | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |