Detections
Analytics

SCA: security update for almirhodzic/nova-toggle-5 (GHSA-f5c8-m5vw-rmgq)

medium Tenable Self-Hosted Container Security Plugin ID 440811

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint
 (POST/nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was protected only by web + auth:<guard>
 middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean
 attributes on any Nova resource — including users who do not have access to Nova itself (for example,
 frontend customers sharing the web guard with the Nova admin area). The endpoint also accepted an
 arbitrary attribute parameter, which meant a valid caller could toggle any boolean column on the
 underlying model — not just columns exposed as Toggle fields on the resource. This issue has been patched
 in version 1.3.0. (CVE-2026-42202)

Solution

Update the almirhodzic/nova-toggle-5 library and its related packages to version 1.3.0 or later.

See Also

https://github.com/advisories/GHSA-f5c8-m5vw-rmgq

Plugin Details

Severity: Medium

ID: 440811

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 4/24/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.68

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N

CVSS Score Source: CVE-2026-42202

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/24/2026

Vulnerability Publication Date: 4/24/2026

Reference Information

CVE: CVE-2026-42202

cwe: CWE-285