{"id":"GHSA-f5c8-m5vw-rmgq","aliases":["CVE-2026-42202"],"title":"nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields","description":"### Impact\n\nIn versions `< 1.3.0`, the toggle endpoint (`POST /nova-vendor/nova-toggle/toggle/{resource}/{resourceId}`) was protected only by `web` + `auth:<guard>` middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself (for example, frontend customers sharing the `web` guard with the Nova admin area).\n\nThe endpoint also accepted an arbitrary `attribute` parameter, which meant a valid caller could toggle any boolean column on the underlying model — not just columns exposed as `Toggle` fields on the resource.\n\n### Patches\n\nFixed in `1.3.0`:\n\n- The route is now protected by Nova's `nova:api` middleware, which enforces the `viewNova` gate.\n- The controller now checks the resource's `authorizedToUpdate` policy.\n- The controller only accepts attributes that are declared as a `Toggle` field on the resource and are not readonly in the current request context.\n\n### Workarounds\n\nUsers who cannot upgrade immediately can either remove the package or restrict access to the `/nova-vendor/nova-toggle/toggle/*` routes via an additional middleware in their application that enforces the `viewNova` gate.\n\n### Credits\n\nnova-toggle-5 thanks [Roberto Negro](https://github.com/RobertoNegro) for the responsible disclosure.","severity":"medium","score":6.5,"published":"2026-04-24T16:00:09.000Z","modified":"2026-05-13T13:52:32.024Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"almirhodzic/nova-toggle-5","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.3.0"}],"type":"ECOSYSTEM"}],"versions":["v1.2.0","v1.2.1"],"fixed":["1.3.0"]}],"sourceAffected":[],"references":["https://github.com/almirhodzic/nova-toggle-5/security/advisories/GHSA-f5c8-m5vw-rmgq","https://nvd.nist.gov/vuln/detail/CVE-2026-42202","https://github.com/almirhodzic/nova-toggle-5","https://github.com/almirhodzic/nova-toggle-5/blob/main/CHANGELOG.md","https://github.com/almirhodzic/nova-toggle-5/releases/tag/v1.3.0"],"sources":[{"name":"OSV","id":"GHSA-f5c8-m5vw-rmgq","modified":"2026-05-13T13:52:32.024632Z","url":"https://osv.dev/vulnerability/GHSA-f5c8-m5vw-rmgq"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":6.5}]}