Executive brief
A vulnerability in the nova-toggle-5 library for Laravel Nova allows unauthorized users to modify data. Any logged-in user, including those without administrative access, could change boolean settings (like 'active' or 'enabled' flags) for any record in the system. This could lead to unauthorized changes in application behavior or user permissions.
Technical details
An improper authorization vulnerability exists in the toggle endpoint (POST /nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) of the nova-toggle-5 package. Prior to version 1.3.0, the endpoint was only protected by basic authentication middleware rather than Laravel Nova's specific authorization gates. This allowed any authenticated user, even those without Nova access, to flip boolean attributes on any resource. Furthermore, the endpoint accepted arbitrary attribute parameters, allowing attackers to modify any boolean column on the underlying database model regardless of whether it was exposed as a toggle field. The fix in version 1.3.0 implements the nova:api middleware and enforces resource-level update policies.
Affected products
- almirhodzic nova-toggle-5 < 1.3.0
Timeline
- 2026-04-20: patched: Version 1.3.0 released
- 2026-05-08: disclosed: CVE-2026-42202 published