{"id":"CVE-2026-42202","aliases":["GHSA-f5c8-m5vw-rmgq"],"url":"https://o3.security/vulnerability/CVE-2026-42202","summary":"nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields","details":"### Impact\n\nIn versions `< 1.3.0`, the toggle endpoint (`POST /nova-vendor/nova-toggle/toggle/{resource}/{resourceId}`) was protected only by `web` + `auth:<guard>` middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself (for example, frontend customers sharing the `web` guard with the Nova admin area).\n\nThe endpoint also accepted an arbitrary `attribute` parameter, which meant a valid caller could toggle any boolean column on the underlying model — not just columns exposed as `Toggle` fields on the resource.\n\n### Patches\n\nFixed in `1.3.0`:\n\n- The route is now protected by Nova's `nova:api` middleware, which enforces the `viewNova` gate.\n- The controller now checks the resource's `authorizedToUpdate` policy.\n- The controller only accepts attributes that are declared as a `Toggle` field on the resource and are not readonly in the current request context.\n\n### Workarounds\n\nUsers who cannot upgrade immediately can either remove the package or restrict access to the `/nova-vendor/nova-toggle/toggle/*` routes via an additional middleware in their application that enforces the `viewNova` gate.\n\n### Credits\n\nnova-toggle-5 thanks [Roberto Negro](https://github.com/RobertoNegro) for the responsible disclosure.","published":"2026-05-08T21:18:58.593Z","modified":"2026-08-12T03:51:33.540172869Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},"epss":{"score":0.00201,"percentile":0.1025,"asOf":"2026-08-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"almirhodzic/nova-toggle-5","fixedVersion":"1.3.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/almirhodzic/nova-toggle-5/releases/tag/v1.3.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42202.json"},{"type":"ADVISORY","url":"https://github.com/almirhodzic/nova-toggle-5/security/advisories/GHSA-f5c8-m5vw-rmgq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42202"},{"type":"PACKAGE","url":"https://github.com/almirhodzic/nova-toggle-5"},{"type":"WEB","url":"https://github.com/almirhodzic/nova-toggle-5/blob/main/CHANGELOG.md"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:33.540172869Z"}}