Novu’s API allows operations such as removal, update, auto‑configuration, and setting an integration as primary. Prior to version 3.18.0 these operations look up an integration by integrationId and organizationId but fail to consistently enforce the environmentId, presenting a classic IDOR flaw. An attacker with access to any environment within an organization can target an integration belonging to a different environment, deleting it, changing its credentials, altering its primary status, or triggering auto‑configuration. The vulnerability threatens confidentiality of integration credentials, integrity of notification provider settings, and availability of the organization’s notification system.

Vulnerable versions of the Novu API Service and Novuhq Novu (any release prior to 3.18.0) are impacted. The 3.18.0 release introduces a partial mitigations by enforcing the environment boundary for environment‑scoped API‑key authentication, but its test suite deliberately preserves cross‑environment dashboard‑session behavior, leaving that part of the advisory scope unresolved.

The CVSS score of 6.5 classifies the issue as moderate but still serious, particularly because failure to isolate environments allows privilege escalation within a tenant. EPSS is not available, yet the advisory identifies both environment‑scoped API keys and regular dashboard sessions as vectors, suggesting that an attacker with appropriate credentials can exploit the flaw. The vulnerability is not listed in KEV, but many users rely on the dashboard to manage integrations, increasing the likelihood of exploitation if they do not enforce API‑key scoping or separate dashboards per environment.