API Vulnerability in Novu Notification Platform

CVE-2026-75517

What is CVE-2026-75517?

The Novu Notification Platform, a service designed for efficient notification handling, has a vulnerability that compromises the API's integrity. Versions prior to 3.18.0 allow an assailant with access to one organizational environment to interact with different environment identifiers without adequate controls. Such actions include unauthorized deletion of integrations, alteration of integration credentials, and manipulation of the primary provider settings. Although version 3.18.0 includes partial mitigations by enforcing environment boundaries through API-key authentication, the issue persists for dashboard session interactions, necessitating further action for complete remediation.

References