An authorization bypass vulnerability in Novu allows authenticated users to modify or delete integrations across different environments within the same organization.

This is an authorization bypass flaw (CWE-639) occurring within integration mutation functions, where the application fails to validate the environmentId for requests. An authenticated user with access to one environment can manipulate integration settings in another environment, provided they share the same organization.

The vulnerability allows for unauthorized modification of notification integrations, which could lead to service disruption, credential compromise, or the hijacking of notification workflows. With a CVSS score of 6.5, this medium-severity flaw poses a significant risk to organizational integrity and operational continuity, particularly for businesses relying on centralized notification management.

Immediate Action: Update Novu to version 3.18.0 or later, and perform a security audit of all existing integrations to ensure no unauthorized cross-environment modifications have occurred. Note that version 3.18.0 is a partial fix; monitor vendor security advisories for further updates regarding dashboard-session boundary enforcement.

Proactive Monitoring: Review application access logs for unusual mutation activity, specifically focusing on integration-related API calls originating from unexpected environment contexts.

Compensating Controls: Implement strict access control policies for API keys and dashboard sessions to limit the number of users capable of performing integration mutations.

Public Exploit Available: No

Organizations utilizing Novu must prioritize the update to version 3.18.0 to enforce environment isolation for API-key based authentication. Given that this patch is noted as partial, administrators should exercise heightened vigilance regarding dashboard sessions and continue to monitor the official repository for subsequent releases that fully resolve the remaining scope of the vulnerability.