CVE-2026-57494: AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-p

AgenticMail, a system that gives AI agents access to real email addresses and phone numbers, has a serious authorization flaw in versions before 0.9.64. A low-privileged agent (an AI with basic permissions) can view and take over tasks assigned to other agents by discovering agent names through a directory and then using those names to access and manipulate tasks they shouldn't have permission to touch, breaking the intended security model that relies on task IDs being secret.