Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was protected only by web + auth:<guard> middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself (for example, frontend customers sharing the web guard with the Nova admin area). The endpoint also accepted an arbitrary attribute parameter, which meant a valid caller could toggle any boolean column on the underlying model — not just columns exposed as Toggle fields on the resource. This issue has been patched in version 1.3.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-42202 nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was pro… https://www.cve.org/CVERecord?id=CVE-2026-42202
Post summary
The post briefly announces CVE‑2026‑42202, describing how the toggle endpoint permits boolean flips before version 1.3.0, but provides no PoC, exploit tools, or patch information.
CVE-2026-42202 Unauthorized Boolean Attribute Manipulation in nova-toggle Prior to Version 1.3.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42202
Post summary
The content merely lists the CVE and provides a link to a vulnerability database, without further detail on exploitation, mitigation, or technical specifics.