6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-f5c8-m5vw-rmgq

GHSA-f5c8-m5vw-rmgq: nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

Impact

In versions < 1.3.0, the toggle endpoint (POST /nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was protected only by web + auth:<guard> middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself (for example, frontend customers sharing the web guard with the Nova admin area).

The endpoint also accepted an arbitrary attribute parameter, which meant a valid caller could toggle any boolean column on the underlying model — not just columns exposed as Toggle fields on the resource.

Patches

Fixed in 1.3.0:

The route is now protected by Nova's nova:api middleware, which enforces the viewNova gate.
The controller now checks the resource's authorizedToUpdate policy.
The controller only accepts attributes that are declared as a Toggle field on the resource and are not readonly in the current request context.

Workarounds

Users who cannot upgrade immediately can either remove the package or restrict access to the /nova-vendor/nova-toggle/toggle/* routes via an additional middleware in their application that enforces the viewNova gate.

Credits

nova-toggle-5 thanks Roberto Negro for the responsible disclosure.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-f5c8-m5vw-rmgq

GHSA-f5c8-m5vw-rmgq:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
almirhodzic/nova-toggle-5	composer	< 1.3.0	1.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows any authenticated user, even those without Nova access, to modify boolean attributes on any Nova resource. This is due to improper authorization on the toggle endpoint. The analysis of the patch commit 1ebf0a153b67d800da29a4bce65a973553b4326d reveals the vulnerable function and the fixes applied.

The primary vulnerable function is ToggleController::toggle. The patch shows the removal of a weak authentication check based on configurable guards and the introduction of robust authorization checks using Nova's own policies (authorizedToUpdate) and middleware (nova:api).

Specifically, the old code in ToggleController.php contained this logic:

// Check authentication against configured guards
$guards = config('nova-toggle-5.guards', ['web']);
$hasAccess = collect($guards)->contains(fn($guard) => auth()->guard($guard)->check());

if (!$hasAccess) {
    return response()->json(['error' => 'Unauthorized'], 403);
}

This was the only authorization check performed. An attacker who is authenticated on the application (e.g., a regular user) could send a request to the toggle endpoint (/nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) and flip any boolean value on any model, as the endpoint also lacked a whitelist for which attributes could be toggled.

The patch addresses this by:

Changing the route middleware in ToggleServiceProvider.php from ['web', 'auth:...'] to ['nova:api'], which ensures only users who can view the Nova dashboard can access the endpoint.
In ToggleController::toggle, adding a check to see if the user is authorized to update the specific resource: if (! $novaResource->authorizedToUpdate($request)) ...
In ToggleController::toggle, adding a check to ensure the attribute being modified is actually defined as a Toggle field on the resource, preventing arbitrary boolean column modification.

Therefore, the function ToggleController::toggle is the exact location where the insufficient authorization checks were performed, making it the vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

ToggleController::toggle

src/Http/Controllers/ToggleController.php

The `toggle` function in `ToggleController` was vulnerable to improper authorization. Before the patch, it only checked for an authenticated user under a configurable guard (defaulting to 'web'), but did not verify if the user had permissions to access the Nova dashboard or update the specific resource. This allowed any authenticated user on the same guard to modify boolean fields on any Nova resource. The patch fixed this by using Nova's `nova:api` middleware, checking the resource's `authorizedToUpdate` policy, and ensuring the attribute is a valid `Toggle` field.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.