Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

almirhodzic/nova-toggle-5

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5PackagistPublished

    nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

    CVE-2026-42202 · GHSA-f5c8-m5vw-rmgq

    Affected
    • Packagist almirhodzic/nova-toggle-5 < 1.3.0
    Fixed in
    1.3.0· Vendor fix available
    Issue
    Impact In versions < 1.3.0, the toggle endpoint (POST /nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was protected only by web + auth:<guard middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself (for example, frontend customers sharing the web guard with the Nova admin area). The endpoint also accepted an arbitrary attribute parameter, which meant a valid caller could toggle any boolean column on the underlying model — not just columns exposed as Toggle fields on the resource. Patches Fixed in 1.3.0: - The route is now protected by Nova's nova:api middleware, which enforces the viewNova gate. - The controller now checks the resource's authorizedToUpdate policy. - The controller only accepts attributes that are declared as a Toggle field on the resource and are not readonly in the current request context. Workarounds Users who cannot upgrade…

    Recommended action: Upgrade to 1.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →