CVE-2026-42202: nova-toggle-5 Auth Bypass Vulnerability

CVE-2026-42202 Overview

CVE-2026-42202 is a broken access control vulnerability [CWE-285] in nova-toggle-5, a Laravel Nova package that exposes a toggle endpoint for flipping boolean attributes on Nova resources. Prior to version 1.3.0, the endpoint POST /nova-vendor/nova-toggle/toggle/{resource}/{resourceId} enforced only web + auth:<guard> middleware. Any user authenticated against the configured guard could invoke the endpoint, including frontend customers sharing the web guard with the Nova admin area. The endpoint also accepted an arbitrary attribute parameter, allowing toggling of any boolean column on the underlying model rather than only columns exposed as Toggle fields.

Critical Impact
Authenticated low-privilege users can modify boolean fields on Nova resources they should not access, including security-relevant flags such as is_admin or is_active.

Affected Products

almirhodzic/nova-toggle-5 versions prior to 1.3.0
Laravel Nova applications integrating the nova-toggle-5 package
Applications where the Nova guard is shared with public-facing authenticated users

Discovery Timeline

2026-05-08 - CVE-2026-42202 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42202

Vulnerability Analysis

The nova-toggle-5 package registers a route that lets administrators flip boolean fields on Nova resources without a full edit workflow. The route is protected only by Laravel's web middleware group and an auth:<guard> check. This guard-based gate confirms only that a request is authenticated, not that the authenticated principal has access to Nova or to the specific resource being modified.

Applications often share the web guard between the Nova admin panel and the public-facing frontend. In that configuration, a logged-in customer can issue requests to the toggle endpoint and alter administrative state. Because the controller does not validate that the attribute parameter corresponds to a Toggle field declared on the resource, callers can target any boolean column on the underlying Eloquent model.

Root Cause

The root cause is missing authorization [CWE-285]. The controller relies on authentication middleware alone and skips Nova's per-resource authorization gates and field-level allowlisting. Both the caller identity check and the attribute allowlist are absent.

Attack Vector

An attacker authenticates against the shared guard using any legitimate account, including a low-privilege customer account. The attacker then sends POST /nova-vendor/nova-toggle/toggle/{resource}/{resourceId} with an attribute value naming a boolean column such as is_admin, is_banned, or email_verified. The endpoint flips the column value, producing integrity impact on administrative state. See the GitHub Security Advisory GHSA-f5c8-m5vw-rmgq for the maintainer's analysis.

Detection Methods for CVE-2026-42202

Indicators of Compromise

Requests to POST /nova-vendor/nova-toggle/toggle/{resource}/{resourceId} originating from sessions that do not belong to Nova administrators.
Audit log entries showing boolean column changes on sensitive models without a corresponding Nova edit action.
Unexpected flips of privilege flags such as is_admin, is_active, or email_verified in user tables.

Detection Strategies

Inspect web server and application logs for the nova-vendor/nova-toggle/toggle/ path and correlate the authenticated user ID with Nova access policies.
Add application-level logging in the toggle controller to record the resource, attribute, and caller identity for every invocation.
Diff database audit trails against expected Nova admin activity windows to surface unauthorized toggles.

Monitoring Recommendations

Alert when the toggle endpoint is called by users lacking the Nova authorization gate.
Monitor for high-frequency requests to the toggle endpoint targeting privilege-related columns.
Track changes to boolean columns that are not registered as Toggle fields on any Nova resource.

How to Mitigate CVE-2026-42202

Immediate Actions Required

Upgrade almirhodzic/nova-toggle-5 to version 1.3.0 or later via Composer.
Audit user tables and other Nova-managed models for unexpected boolean state changes.
Review which guards are shared between Nova and public authenticated areas and segregate them where feasible.

Patch Information

The maintainer released the fix in GitHub Release v1.3.0. The patched version enforces Nova's authorization gate on the toggle endpoint and restricts mutable attributes to those explicitly declared as Toggle fields on the resource.

Workarounds

Block the nova-vendor/nova-toggle/toggle/* route at the reverse proxy or web application firewall for non-admin sessions until the upgrade is applied.
Configure a dedicated guard for Nova that is not shared with public frontend authentication.
Temporarily remove the package registration if the toggle functionality is not in active administrative use.

bash

# Configuration example
composer require almirhodzic/nova-toggle-5:^1.3.0
php artisan route:clear
php artisan config:clear