The vulnerability in nova-toggle-5 (before version 1.3.0) involves insufficient authorization checks on the toggle endpoint (POST /nova-vendor/nova-toggle/toggle/{resource}/{resourceId}). It was protected only by web + auth:<guard> middleware, allowing any user authenticated on that guard to toggle boolean attributes on any Nova resource. This includes users without Nova access, such as frontend customers sharing the web guard with the Nova admin area. The endpoint also accepted arbitrary attribute parameters, permitting toggling of any boolean column on the model, not just those exposed as toggle fields. This improper authorization (CWE-285) could lead to unauthorized modification of resource attributes. The issue is patched in version 1.3.0.

An attacker with any authenticated access on the configured guard could modify boolean attributes on any Nova resource, including those they should not have access to. This could lead to unauthorized changes in application state or behavior, potentially impacting integrity. Confidentiality and availability impacts are not indicated. The CVSS score is 6.5 (medium severity), reflecting the ease of exploitation with low attack complexity and no user interaction required.

Upgrade nova-toggle-5 to version 1.3.0 or later, where the authorization issue has been fixed. No other official remediation or temporary fixes are indicated. Patch status is not explicitly stated but the vendor has released a fixed version. Users should apply this update to prevent unauthorized toggling of boolean attributes.