What is the CVSS score of CVE-2026-42202?

CVE-2026-42202 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42202?

Yes, a patch is available for CVE-2026-42202. Update the affected software to the latest version immediately.

nova-toggle-5 CVE-2026-42202

EUVD-2026-28835 MEDIUM

Improper Authorization (CWE-285)

2026-05-08 GitHub_M

Authentication Bypass Nova Toggle 5

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Endpoint is network-accessible over HTTP (AV:N); only a valid guard session is required (PR:L); arbitrary boolean column writes constitute high integrity impact with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 22:41 vuln.today

Analysis Generated

Jul 23, 2026 - 22:41 vuln.today

Patch available

May 08, 2026 - 23:18 EUVD

CVE Published

May 08, 2026 - 21:18 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was protected only by web + auth:<guard> middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource - including users who do not have access to Nova itself (for example, frontend customers sharing the web guard with the Nova admin area). The endpoint also accepted an arbitrary attribute parameter, which meant a valid caller could toggle any boolean column on the underlying model - not just columns exposed as Toggle fields on the resource. This issue has been patched in version 1.3.0.

AnalysisAI

Unauthorized boolean field manipulation in nova-toggle-5 (versions prior to 1.3.0) allows any user authenticated on the shared Laravel web guard to call the Nova toggle endpoint and flip boolean columns on any model - even without Nova admin access. The endpoint's attribute parameter accepted arbitrary column names, bypassing field-level exposure controls and permitting writes to columns never declared as Toggle fields. No public exploit has been identified (EPSS 0.03%, SSVC exploitation: none), but the integrity impact is rated High because critical boolean flags such as is_admin or is_active on any resource are writable.

Technical ContextAI

nova-toggle-5 is a third-party Laravel Nova package (Composer: almirhodzic/nova-toggle-5, CPE: cpe:2.3:a:almirhodzic:nova-toggle-5:*:*:*:*:*:*:*:*) that adds inline boolean toggling to Nova resource index views. It registered a POST route at /nova-vendor/nova-toggle/toggle/{resource}/{resourceId} protected only by Laravel's built-in web session and auth:<guard> middleware. That middleware stack confirms identity (authentication) but does not evaluate Nova's viewNova gate or any Nova resource policy (authorization), which is the core of CWE-285 (Improper Authorization). The compounding issue is that the endpoint accepted a freeform attribute request parameter with no allowlist check, so any valid caller could target any boolean column on the Eloquent model - not only fields exposed through the Nova Toggle field definition. The fix in v1.3.0 migrates the route to Nova's nova:api middleware (enforcing viewNova), adds authorizedToUpdate policy evaluation per resource, and restricts the attribute parameter to fields explicitly declared as Toggle and not readonly in the current request context.

RemediationAI

Vendor-released patch: 1.3.0, available at https://github.com/almirhodzic/nova-toggle-5/releases/tag/v1.3.0. Upgrade by running composer update almirhodzic/nova-toggle-5 - the vendor describes this as a drop-in upgrade for most installations. Note the breaking change: the config/nova-toggle-5.php file and its guards option are removed in 1.3.0; installations that previously published this config and relied on its guards setting to grant non-Nova users toggle access must reassign those users through the viewNova gate before upgrading, or those users will lose toggle access. If immediate upgrade is not possible, the vendor advisory recommends either removing the package entirely or adding application middleware that enforces the viewNova gate to the /nova-vendor/nova-toggle/toggle/* route group - this blocks non-Nova users from reaching the endpoint without requiring code changes to the package itself. A network-layer block on the /nova-vendor/ path prefix for non-admin origins is also viable as a temporary compensating control, but will break legitimate Nova Toggle functionality for admin users accessing from affected origins.