Cloudanix VulnDB

GHSA-f5c8-m5vw-rmgq

Medium · 6.5

nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

CVSS

6.5

EPSS

—

Published

Apr 24, 2026

CISA due date

—

The record

In versions `< 1.3.0`, the toggle endpoint (`POST /nova-vendor/nova-toggle/toggle/{resource}/{resourceId}`) was protected only by `web` + `auth:<guard>` middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself (for example, frontend customers sharing the `web` guard with the Nova admin area). The endpoint also accepted an arbitrary `attribute` parameter, which meant a valid caller could toggle any boolean column on the underlying model — not just columns exposed as `Toggle` fields on the resource.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities