almirhodzic nova-toggle-5 up to 1.2.x Endpoint toggle improper authorization

Summaryinfo

A vulnerability marked as critical has been reported in almirhodzic nova-toggle-5 up to 1.2.x. This affects an unknown function of the file POST/nova-vendor/nova-toggle/toggle/ of the component Endpoint. This manipulation causes improper authorization. The identification of this vulnerability is CVE-2026-42202. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in almirhodzic nova-toggle-5 up to 1.2.x. Affected by this vulnerability is an unknown code of the file POST/nova-vendor/nova-toggle/toggle/ of the component Endpoint. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was protected only by web + auth: middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself (for example, frontend customers sharing the web guard with the Nova admin area). The endpoint also accepted an arbitrary attribute parameter, which meant a valid caller could toggle any boolean column on the underlying model — not just columns exposed as Toggle fields on the resource. This issue has been patched in version 1.3.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-42202 since 04/25/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 1.3.0 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• almirhodzic

Name

• nova-toggle-5

Version

• 1.0
• 1.1
• 1.2

Website

• Product: https://github.com/almirhodzic/nova-toggle-5/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion