CVE-2026-75517

Prior to version 3.18.0 , Novu is vulnerable to a cross-environment integration manipulation (IDOR) because mutation use cases—such as remove-integration , update-integration , auto-configure-integration , and set-integration-as-primary —fail to consistently enforce environmentId . An attacker wi...

PT-2026-96822

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 Description Novu provides an API for sending notifications through multiple channels. Certain integration mutation use cases fail to consistently enforce the environmentId when looking up an integration by...

CVE-2026-75517: Authorization Bypass Through User-Controlled Key

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId...