Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 2 total.
Library:
@agenticmail/api
CVE-2026-57494
HIGH
CVSS 7.1
Verified Advisory
Jul 20, 2026
Cross-agent authorization bypass in AgenticMail API (CVE-2026-57494)
A low-privileged authenticated AgenticMail agent can enumerate another agent's pending and claimed tasks by supplying the target agent name to `GET /api/agenticmail/tasks/pending?assignee=<name>`, disclosing task IDs ...
Fixed in 0.9.64
Authentication Bypass
CVE-2026-47255
HIGH
CVSS 8.2
Verified Advisory
Jul 20, 2026
Input validation and SQL injection flaws in AgenticMail API and Core (CVE-2026-47255)
Multiple improper input validation and SQL injection vulnerabilities affect the AgenticMail API and Core packages, allowing unauthenticated remote attackers to manipulate SQL commands, bypass storage ownership checks,...
Fixed in @agenticmail/api 0.9.32; @agenticmail/core 0.9.10
Information Disclosure