Auth bypass in Agenticmail @Agenticmail/api
CVE-2026-57494
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target a…
Vulnerability class: IDOR (Insecure Direct Object Reference)
Affected products
- Agenticmail @Agenticmail/api — versions < 0.9.64
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)