CVE-2026-75517: Novu: Cross-Environment Integration Manipulation (IDOR)
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId without consistently enforcing environmentId. A caller with access to one environment in an organization can target an integration identifier from another environment and delete the integration, modify its credentials, change the primary provider, or trigger auto-configuration. The repository advisory defines both environment API keys and dashboard sessions as affected. The 3.18.0 change enforces the environment boundary only for environment-scoped API-key authentication, while its tests intentionally retain cross-environment dashboard-session behavior, so it does not completely remediate the advisory-defined scope. Version 3.18.0 is a partial fix attempt, and the dashboard-session behavior requires curator resolution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Novuto a version that resolves this vulnerability.Fixed in 3.18.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A caller needs access to one environment within the same organization and an integration identifier belonging to another environment. Both environment API keys and dashboard sessions are identified as affected by the advisory.
What actions can an attacker perform across environments?
They may delete an integration, modify its credentials, set a different primary provider, or trigger integration auto-configuration in another environment within the organization.
Does upgrading to 3.18.0 fully resolve the issue?
No. Version 3.18.0 enforces the environment boundary for environment-scoped API-key authentication, but its tests retain cross-environment behavior for dashboard sessions; the dashboard-session exposure requires further resolution.