Executive brief
AgenticMail, a tool that provides AI agents with email and phone capabilities, contains a security flaw that allows one AI agent to interfere with another. An authenticated user can discover the names of other agents, view their private tasks, and even complete or fail those tasks on their behalf. This could lead to the exposure of sensitive information contained in task payloads and allow unauthorized actors to disrupt or manipulate automated business workflows.
Technical details
A vulnerability in @agenticmail/api prior to version 0.9.64 stems from missing authorization checks in task-related endpoints. An authenticated attacker can first use the `/accounts/directory` endpoint to discover other agent names. By passing a victim's name to the `GET /api/agenticmail/tasks/pending?assignee=<name>` endpoint, the attacker can retrieve task IDs and sensitive payloads. Because the API uses a capability-style model without verifying the caller's relationship to the task, the attacker can then use these IDs with mutation endpoints (such as `/tasks/:id/complete` or `/tasks/:id/fail`) to hijack or disrupt the victim agent's workflow. The issue is fixed in version 0.9.64.
Affected products
- AgenticMail @agenticmail/api < 0.9.64
Timeline
- 2026-06-18: advisory: GitHub advisory published by maintainers
- 2026-07-20: disclosed: CVE published to NVD
- 2026-07-20: patched: Version 0.9.64 released with fixes