CVE-2026-57494

Received Received - Intake

Authorization Bypass in AgenticMail API

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to `GET /api/agenticmail/tasks/pending?assignee=<name>`. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (`/tasks/:id/claim`, `/tasks/:id/result`, `/tasks/:id/complete`, `/tasks/:id/fail`) to claim, complete, or fail tasks assigned to a different agent. Because ordinary authenticated agents can discover agent names through `GET /api/agenticmail/accounts/directory`, the task ID effectively stops being a secret capability. This turns the intended capability model into a cross-agent authorization bypass. Version 0.9.64 contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-57494

Affected Vendors & Products

Vendor	Product	Version / Range
agenticmail	api	to 0.9.64 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

AgenticMail allows AI agents to have email addresses and phone numbers. A flaw in versions before 0.9.64 lets low-privileged authenticated agents list another agent's pending tasks by providing the target agent's name. The response includes task IDs and payloads. These IDs can then be used to claim, complete, or fail tasks assigned to a different agent, bypassing intended access controls.

Detection Guidance

Check API endpoints for unauthorized task enumeration by querying GET /api/agenticmail/tasks/pending?assignee=<name> with different agent names. Monitor for unusual task ID usage across mutation endpoints like /tasks/:id/claim or /tasks/:id/result.

Impact Analysis

An attacker could access sensitive task data or manipulate tasks assigned to other agents. This could lead to unauthorized data exposure, task interference, or service disruption if tasks are improperly completed or failed.

Compliance Impact

This vulnerability could violate data protection requirements by enabling unauthorized access to sensitive task payloads, potentially exposing personal or confidential information. Compliance with GDPR, HIPAA, or similar regulations may be compromised due to insufficient access controls.

Mitigation Strategies

Upgrade @agenticmail/api to version 0.9.64 or later to apply the fix. Restrict access to task enumeration endpoints and validate task ownership before mutation operations.

Hi! I’m here to help you understand CVE-2026-57494. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70