AgenticMail allows authenticated agents with low privileges to enumerate the pending tasks of any agent by requesting the pending task list with an arbitrary assignee name. The response includes the identifiers and payload data of each task, which an attacker can then reuse in mutation endpoints to claim, complete, or fail tasks that belong to other agents. This circumvents the intended capability‑based access model; the attacker effectively gains authorization to act on resources they should not control. Inferred from the description, the obtained payload data may contain sensitive information, potentially exposing confidential content to the attacker.

The vulnerability affects the AgenticMail API service, specifically @agenticmail/api versions older than 0.9.64. Any instance of that API running without the 0.9.64 patch or a later revision is susceptible to this cross‑agent authorization bypass.

The CVSS v3.1 base score of 7.1 classifies this as a high‑impact vulnerability. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated as a low‑privilege agent and have network access to the API. By enumerating tasks and re‑using their identifiers, the attacker can lift privileges across agents and potentially expose sensitive task content, creating a cross‑agent authorization bypass.