The flaw exists because the toggle endpoint is protected only by generic authentication middleware. Any authenticated user on the configured guard can POST to the endpoint and flip boolean attributes on any Nova resource, including resources the caller should not have access to. The endpoint also accepts arbitrary attribute names, allowing a valid caller to toggle any boolean column in the underlying database. The issue was fixed in version 1.3.0.

The vulnerability affects applications that incorporate the nova-toggle-5 package from almirhodzic prior to release v1.3.0. The package exposes a POST route at /nova-vendor/nova-toggle/toggle/{resource}/{resourceId}. Any deployment using this package without upgrading is vulnerable.

The CVSS score of 6.5 indicates a moderate‐to‑high severity. The EPSS score is not available and the vulnerability is not in CISA KEV. Because the attacker only needs an authenticated session that satisfies the guard used for Nova, the attack vector is web-based and readily exploitable. The lack of fine‑grained authorization therefore makes the flaw a significant risk for any system that exposes Nova to shared or non‑admin user pools.