CVE-2026-75517
Received Received - Intake

Privilege Escalation in Novu API Integration

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId without consistently enforcing environmentId. A caller with access to one environment in an organization can target an integration identifier from another environment and delete the integration, modify its credentials, change the primary provider, or trigger auto-configuration. The repository advisory defines both environment API keys and dashboard sessions as affected. The 3.18.0 change enforces the environment boundary only for environment-scoped API-key authentication, while its tests intentionally retain cross-environment dashboard-session behavior, so it does not completely remediate the advisory-defined scope. Version 3.18.0 is a partial fix attempt, and the dashboard-session behavior requires curator resolution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-75517
EUVD
EUVD-2026-84538

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
novu novu to 3.17.0 (inc)
novu novu to 3.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75517 is a Cross-Environment Integration Manipulation vulnerability affecting Novu's API service versions 3.17.0 and earlier. It allows authenticated users with access to one environment to manipulate integrations in another environment within the same organization by exploiting insufficient environment scoping in integration management operations.

Detection Guidance

To detect CVE-2026-75517, check Novu API versions <= 3.17.0 for integration mutations lacking environment scoping. Review logs for cross-environment requests modifying integrations. Use API key authentication tests to verify environment restrictions. Check for unauthorized delete, update, or auto-configure operations targeting different environments within the same organization.

Impact Analysis

An attacker could delete or modify integrations in other environments, causing notification failures, credential leaks, or redirection of notifications. This could disrupt services relying on Novu for notifications and expose sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access or data manipulation across environments, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized changes to integrations may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade Novu to version 3.18.0 or later to enforce environment scoping for API key authentication. Review and restrict cross-environment access in JWT and session-based authentication. Implement additional validation checks for integration mutations. Monitor for unauthorized integration modifications and test environment scoping with regression tests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75517. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart