{"id":"GHSA-f5c8-m5vw-rmgq","summary":"nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields","details":"### Impact\n\nIn versions `\u003c 1.3.0`, the toggle endpoint (`POST /nova-vendor/nova-toggle/toggle/{resource}/{resourceId}`) was protected only by `web` + `auth:\u003cguard\u003e` middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself (for example, frontend customers sharing the `web` guard with the Nova admin area).\n\nThe endpoint also accepted an arbitrary `attribute` parameter, which meant a valid caller could toggle any boolean column on the underlying model — not just columns exposed as `Toggle` fields on the resource.\n\n### Patches\n\nFixed in `1.3.0`:\n\n- The route is now protected by Nova's `nova:api` middleware, which enforces the `viewNova` gate.\n- The controller now checks the resource's `authorizedToUpdate` policy.\n- The controller only accepts attributes that are declared as a `Toggle` field on the resource and are not readonly in the current request context.\n\n### Workarounds\n\nUsers who cannot upgrade immediately can either remove the package or restrict access to the `/nova-vendor/nova-toggle/toggle/*` routes via an additional middleware in their application that enforces the `viewNova` gate.\n\n### Credits\n\nnova-toggle-5 thanks [Roberto Negro](https://github.com/RobertoNegro) for the responsible disclosure.","aliases":["CVE-2026-42202"],"modified":"2026-05-13T13:52:32.024632Z","published":"2026-04-24T16:00:09Z","database_specific":{"github_reviewed_at":"2026-04-24T16:00:09Z","nvd_published_at":"2026-05-08T22:16:31Z","cwe_ids":["CWE-285"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/almirhodzic/nova-toggle-5/security/advisories/GHSA-f5c8-m5vw-rmgq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42202"},{"type":"PACKAGE","url":"https://github.com/almirhodzic/nova-toggle-5"},{"type":"WEB","url":"https://github.com/almirhodzic/nova-toggle-5/blob/main/CHANGELOG.md"},{"type":"WEB","url":"https://github.com/almirhodzic/nova-toggle-5/releases/tag/v1.3.0"}],"affected":[{"package":{"name":"almirhodzic/nova-toggle-5","ecosystem":"Packagist","purl":"pkg:composer/almirhodzic/nova-toggle-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}],"versions":["v1.2.0","v1.2.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-f5c8-m5vw-rmgq/GHSA-f5c8-m5vw-rmgq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}