CVE-2026-42202

nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was protected only by web + auth:<guard> middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself (for example, frontend customers sharing the web guard with the Nova admin area). The endpoint also accepted an arbitrary attribute parameter, which meant a valid caller could toggle any boolean column on the underlying model — not just columns exposed as Toggle fields on the resource. This issue has been patched in version 1.3.0.

• CWE-285

• https://github.com/almirhodzic/nova-toggle-5/releases/tag/v1.3.0
• https://github.com/almirhodzic/nova-toggle-5/security/advisories/GHSA-f5c8-m5vw-rmgq

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42197RELATE is a web-based courseware package. Versions prior to …8.7
• CVE-2026-42198pgjdbc is an open source postgresql JDBC Driver. From versio…7.5
• CVE-2026-42199Grid is a data structure grid for rust. From version 0.17.0 …6.2
• CVE-2026-4220A vulnerability has been found in Technologies Integrated Ma…7.3
• CVE-2026-42200Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-42201Coolify is an open-source and self-hostable tool for managin…3.3
• CVE-2026-42203LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…8.8
• CVE-2026-42204Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-42205Avo is a framework to create admin panels for Ruby on Rails …8.8
• CVE-2026-42206Roadiz is a polymorphic content management system based on a…5.7
• CVE-2026-42207Magento Long Term Support (LTS) is an unofficial, community-…6.1
• CVE-2026-42208LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…9.8