What is the CVSS score of CVE-2026-42202?

CVE-2026-42202 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42202?

Yes, a patch is available for CVE-2026-42202. Update the affected software to the latest version immediately.

Nova Toggle 5 CVE-2026-42202

EUVD-2026-28835 MEDIUM

Improper Authorization (CWE-285)

2026-05-08 GitHub_M

Authentication Bypass Nova Toggle 5

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 08, 2026 - 23:18 EUVD

CVE Published

May 08, 2026 - 21:18 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was protected only by web + auth:<guard> middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource - including users who do not have access to Nova itself (for example, frontend customers sharing the web guard with the Nova admin area). The endpoint also accepted an arbitrary attribute parameter, which meant a valid caller could toggle any boolean column on the underlying model - not just columns exposed as Toggle fields on the resource. This issue has been patched in version 1.3.0.