CVE-2026-75517

In Novu prior to 3.18.0, integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId without consistently enforcing environmentId. A caller with access to one environment in an organization can target an integration identifier from another environment and delete the integration, modify its credentials, change the primary provider, or trigger auto-configuration. The repository advisory defines both environment API keys and dashboard sessions as affected. The 3.18.0 change enforces the environment boundary only for environment-scoped API-key authentication, while its tests intentionally retain cross-environment dashboard-session behavior, so it does not completely remediate the advisory-defined scope. Version 3.18.0 is a partial fix attempt, and the dashboard-session behavior requires curator resolution.

A user with access to one environment can modify or delete integrations in other environments, potentially causing service disruption, credential leakage, or unauthorized configuration changes. The risk is high in multi-tenant environments.

Update Novu to version 3.18.0 or later, but note that the fix is partial. Restrict access to dashboard sessions and API keys, and monitor for unusual cross-environment integration operations.