CVE-2026-75517: Novu: Cross-Environment Integration Manipulation (IDOR)

Published Sep 22, 2026
·
Updated

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId without consistently enforcing environmentId. A caller with access to one environment in an organization can target an integration identifier from another environment and delete the integration, modify its credentials, change the primary provider, or trigger auto-configuration. The repository advisory defines both environment API keys and dashboard sessions as affected. The 3.18.0 change enforces the environment boundary only for environment-scoped API-key authentication, while its tests intentionally retain cross-environment dashboard-session behavior, so it does not completely remediate the advisory-defined scope. Version 3.18.0 is a partial fix attempt, and the dashboard-session behavior requires curator resolution.

Affected Software

1 affected component
Novu Novu<3.18.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Novu to a version that resolves this vulnerability.

    Fixed in 3.18.0

Event History

Sep 22, 2026
CVE Published
via MITRE·03:51 PM
Data Sourced
via MITRE·03:51 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this issue?

A caller needs access to one environment within the same organization and an integration identifier belonging to another environment. Both environment API keys and dashboard sessions are identified as affected by the advisory.

2

What actions can an attacker perform across environments?

They may delete an integration, modify its credentials, set a different primary provider, or trigger integration auto-configuration in another environment within the organization.

3

Does upgrading to 3.18.0 fully resolve the issue?

No. Version 3.18.0 enforces the environment boundary for environment-scoped API-key authentication, but its tests retain cross-environment behavior for dashboard sessions; the dashboard-session exposure requires further resolution.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203