Novu EUVD-2026-84538

Requires an authenticated foothold - a valid environment-scoped API key OR a dashboard (JWT) session - for at least one environment within the target Novu organization; the attacker must also know or enumerate the target integrationId of a different environment in the same organization. Exploitation targets the integration mutation endpoints (remove-integration, update-integration, auto-configure-integration, set-integration-as-primary). Limiting factors: no unauthenticated path (attacker must already be an org member/hold a key), and after v3.18.0 the API-key vector is blocked ('is scoped to a single environment', HTTP 403) - but dashboard-session/JWT exploitation remains possible even on 3.18.0 because the fix intentionally does not cover it. Cross-organization access is not possible; the boundary crossed is between environments within one organization.

This is a genuine but moderate-severity authorization flaw, not an inflated high-CVSS finding. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, 6.5) correctly captures a network-reachable, low-complexity, authenticated integrity/availability issue with no confidentiality impact - the attacker cannot read integration secrets, only overwrite, delete, re-point, or auto-configure them across environment boundaries. No EPSS, KEV, or POC data was provided, so exploitation status is 'no public exploit identified at time of analysis'; the flaw is IDOR-style (CWE-639) and trivially scriptable once an attacker holds a valid credential in any one environment of the target organization, but it is not opportunistically internet-mass-exploitable because it requires an authenticated foothold. A critical nuance from the advisory: the 3.18.0 'fix' is only partial - it enforces the environmentId boundary for environment-scoped API-key authentication but its own tests intentionally preserve cross-environment behavior for dashboard-session (JWT) auth, so dashboard-session exploitation remains unremediated and 'requires curator resolution.' Defenders should treat 3.18.0 as incomplete rather than a clean fix. There is a mild PR disagreement to verify: the vendor chose PR:H, but the description only requires 'access to one environment in an organization,' which reads like an ordinary org member (PR:L) rather than a high-privilege actor.

An attacker holding a legitimate credential (environment API key or dashboard session) for a single, low-value environment in a Novu organization enumerates or obtains an integrationId belonging to a different, higher-value environment (e.g. Production). They call a mutation endpoint such as DELETE /v1/integrations/:integrationId, set-primary, or auto-configure; because the lookup only checks integrationId + organizationId and not environmentId, the request succeeds cross-environment, letting them delete the integration, overwrite provider credentials, or change the primary provider. No public exploit code is identified, but the attack is low-complexity and scriptable given valid authentication.