Webhook URL Manipulation in Novu Notification API by Novu
CVE-2026-75511

5.3MEDIUM

Key Information:

Vendor

Novuhq

Status
Novu
Api-service
Vendor
CVE Published:
22 September 2026

What is CVE-2026-75511?

The Novu Notification API allows users to send notifications through various channels. Versions before 3.18.0 are vulnerable to a manipulation issue involving webhook URLs. This flaw enables authenticated users to substitute internal or restricted URLs, bypassing crucial security measures like URL normalization and DNS pinning. As a result, attackers can direct POST requests to sensitive internal services, potentially leading to unauthorized interactions with those services. This vulnerability has been patched in version 3.18.0.

Affected Version(s)

api-service < 3.18.0

novu < 3.18.0

References

https://github.com/novuhq/novu/security/advisories/GHSA-p...
x_refsource_CONFIRM
https://github.com/novuhq/novu/pull/11455
x_refsource_MISC
https://github.com/novuhq/novu/commit/dabfd66457c0b98ad46...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.