CVE-2026-75517: Novu API Auth Bypass Vulnerability

CVE-2026-75517 Overview

Novu is an open-source notification infrastructure that provides an API for sending notifications through multiple channels. Versions prior to 3.18.0 contain an insecure direct object reference [CWE-639] in integration mutation use cases. The affected operations include remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary. These handlers look up integrations by integrationId and organizationId without consistently enforcing environmentId. A caller authenticated to one environment within an organization can target integration identifiers from another environment. Version 3.18.0 provides a partial fix that only enforces the boundary for environment-scoped API-key authentication.

Critical Impact
A caller with access to one environment can delete integrations, modify credentials, change the primary provider, or trigger auto-configuration in a sibling environment within the same organization.

Affected Products

Novu (self-hosted and cloud) versions prior to 3.18.0
Novu API service integration mutation endpoints
Novu dashboard-session authentication flows (remains vulnerable in 3.18.0)

Discovery Timeline

2026-09-22 - CVE-2026-75517 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-75517

Vulnerability Analysis

The vulnerability is an authorization flaw classified as insecure direct object reference [CWE-639]. Novu organizes tenants into organizations, and each organization contains multiple environments such as Development and Production. Integrations are scoped to a specific environment. The affected use cases resolve an integration record using only the integrationId and organizationId fields. The active environmentId from the caller's session or API key is not enforced during the database lookup. This allows a caller authorized in one environment to reference identifiers belonging to another environment in the same organization. The result is unauthorized modification of notification provider configuration across environment boundaries.

Root Cause

The underlying cause is missing environment scoping in the repository queries backing the four mutation use cases. The lookup predicates omit _environmentId, breaking the tenant isolation model that Novu documents between environments.

Attack Vector

Exploitation requires an authenticated principal with high privileges within the organization, such as valid API-key access to one environment or a valid dashboard session. The attacker submits a mutation request against a target endpoint while supplying an integrationId from a different environment. The server executes the operation because it fails to validate environment ownership.

typescript

// Security patch: e2e test added in remove-integration.e2e.ts
// Source: https://github.com/novuhq/novu/commit/3d9bbdccf4e36224b5558c245d2b7c085b5d5302
import { HttpStatus } from '@nestjs/common';
import { EnvironmentRepository, IntegrationRepository } from '@novu/dal';
import { ChannelTypeEnum, ChatProviderIdEnum, EmailProviderIdEnum, PushProviderIdEnum } from '@novu/shared';
import { UserSession } from '@novu/testing';
import { expect } from 'chai';

describe('Delete Integration - /integration/:integrationId (DELETE) #novu-v2', () => {
  let session: UserSession;
  const integrationRepository = new IntegrationRepository();
  const envRepository = new EnvironmentRepository();

  beforeEach(async () => {
    session = new UserSession();
    await session.initialize();
  });
});

The test coverage added in the 3.18.0 patch validates that API-key authenticated callers cannot mutate an integration in a different environment. See the GitHub commit for the complete patch.

Detection Methods for CVE-2026-75517

Indicators of Compromise

Integration mutation API calls where the integrationId in the request path resolves to a different environment than the caller's authenticated environment.
Unexpected deletion or modification of integration records in production environments, correlated with API keys or sessions scoped to non-production environments.
Provider credential changes on integrations without corresponding audit entries from the owning environment.

Detection Strategies

Compare the _environmentId of mutated integration records against the environment context recorded on the request in application logs.
Alert on any successful DELETE, PATCH, or POST /auto-configure calls to /integrations/:integrationId where the resolved integration environment differs from the caller's environment.
Review dashboard-session activity for cross-environment mutations, since 3.18.0 does not remediate this authentication path.

Monitoring Recommendations

Ingest Novu API access logs into a centralized SIEM and enrich mutation events with environment and organization context.
Track baselines of integration mutation volume per environment and alert on anomalous spikes from a single principal.
Maintain a change-audit dashboard for notification provider credentials, particularly for production email, SMS, push, and chat providers.

How to Mitigate CVE-2026-75517

Immediate Actions Required

Upgrade Novu to version 3.18.0 or later to apply the API-key scoping fix for integration mutations.
Rotate any provider credentials stored in Novu integrations if cross-environment activity is suspected.
Restrict dashboard access to trusted administrators until the dashboard-session portion of the advisory is fully remediated.

Patch Information

Version 3.18.0 partially addresses the vulnerability by enforcing environmentId on lookups made by environment-scoped API-key authentication. The dashboard-session path intentionally retains cross-environment behavior in the 3.18.0 tests and requires further curator resolution. Review the GitHub Release v3.18.0, the Pull Request Discussion, and the GitHub Security Advisory GHSA-jh6r-hjhp-wh2h for full details.

Workarounds

Limit organization membership so that a single principal does not hold access across multiple environments where possible.
Segregate high-value production integrations into distinct organizations rather than relying solely on environment separation until dashboard-session enforcement is complete.
Audit integration mutations regularly and revoke unused API keys to reduce the pool of privileged callers.

bash

# Upgrade self-hosted Novu deployment to the patched release
npm install @novu/api@3.18.0
# Or via container image tag
docker pull ghcr.io/novuhq/novu/api:v3.18.0