GHSA-f5c8-m5vw-rmgq nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

• Packagist almirhodzic/nova-toggle-5: < 1.3.0 → fixed in 1.3.0

Impact In versions `` middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself (for example, frontend customers sharing the `web` guard with the Nova admin area). The endpoint also accepted an arbitrary `attribute` parameter, which meant a valid caller could toggle any boolean column on the underlying model — not just columns exposed as `Toggle` fields on the resource. Patches Fixed in `1.3.0`: • The route is now protected by Nova's `nova:api` middleware, which enforces the `viewNova` gate. • The controller now checks the resource's `authorizedToUpdate` policy. • The controller only accepts attributes that are declared as a `Toggle` field on the resource and are not readonly in the current request context. Workarounds Users who cannot upgrade immediately can either remove the package or restrict access to the `/nova-vendor/nova-toggle/toggle/*` routes via an additional middleware in their application that enforces the `viewNova` gate. Credits nova-toggle-5 thanks Roberto Negro for the responsible disclosure.