How severe is GHSA-hjwc-26pj-v3pm?

No CVSS score has been assigned to GHSA-hjwc-26pj-v3pm yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-hjwc-26pj-v3pm?

GHSA-hjwc-26pj-v3pm affects the following packages: @agenticmail/api (npm). Ecosystems affected: npm.

How do I fix GHSA-hjwc-26pj-v3pm?

Update @agenticmail/api to 0.9.64 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hjwc-26pj-v3pm is resolved across your whole dependency graph.

How do I detect GHSA-hjwc-26pj-v3pm in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @agenticmail/api. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-hjwc-26pj-v3pm if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-hjwc-26pj-v3pm?

O3 pinpoints whether GHSA-hjwc-26pj-v3pm is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-hjwc-26pj-v3pm actively exploited in the wild?

No public exploit code has been indexed for GHSA-hjwc-26pj-v3pm yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for GHSA-hjwc-26pj-v3pm?

GHSA-hjwc-26pj-v3pm has an EPSS (Exploit Prediction Scoring System) score of 0.2%, placing it in the 13th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is GHSA-hjwc-26pj-v3pm?

GHSA-hjwc-26pj-v3pm is classified as CWE-639 (CWE-639), CWE-862 (CWE-862). These weakness types describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was GHSA-hjwc-26pj-v3pm published, and has it been updated?

GHSA-hjwc-26pj-v3pm was published on June 18, 2026 and was last updated on July 20, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 npm

GHSA-hjwc-26pj-v3pm

AgenticMail: Cross-agent task authorization bypass in AgenticMail API

Also known asCVE-2026-57494

Published

Jun 18, 2026

Updated

Jul 20, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

EPSS Exploitation Probability

via FIRST.org ↗

0.2%probability of exploitation in next 30 days

Lower Risk13th percentile0.00%

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

1 pkg affected

📦@agenticmail/api

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.

Description

Summary

A low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=<name>. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (/tasks/:id/claim, /tasks/:id/result, /tasks/:id/complete, /tasks/:id/fail) to claim, complete, or fail tasks assigned to a different agent.

Because ordinary authenticated agents can discover agent names through GET /api/agenticmail/accounts/directory, the task ID effectively stops being a secret capability. This turns the intended capability model into a cross-agent authorization bypass.

Affected component

Package: @agenticmail/api Observed version: 0.9.62 Repository: agenticmail/agenticmail

Relevant code paths:

packages/api/src/app.ts: createAuthMiddleware(...) is mounted before createAccountRoutes(...) and createTaskRoutes(...), so these routes are reachable by any valid bearer token.
packages/api/src/routes/accounts.ts: GET /accounts/directory is available to any authenticated user and returns agent names.
packages/api/src/routes/tasks.ts: GET /tasks/pending?assignee=name resolves arbitrary agent names and returns that agent's pending/claimed tasks.
packages/api/src/routes/tasks.ts: /tasks/:id/claim, /tasks/:id/result, /tasks/:id/complete, /tasks/:id/fail, and /tasks/:id do not check whether the authenticated caller is the task assignee, assigner, or otherwise authorized for the task.

Impact

An attacker only needs a valid agent API key. They can:

List agent names using /accounts/directory.
Query another agent's task queue using /tasks/pending?assignee=<victimName>.
Read sensitive task payloads intended for the victim agent.
Use the disclosed task ID to complete/fail/claim the victim's task or submit attacker-controlled results.

Local reproduction

I reproduced this locally with a focused Vitest test mounted directly on createTaskRoutes. The test creates two agents, Alice and Bob, and one pending task assigned to Bob. Alice authenticates with her own agent key and performs the following sequence:

GET /api/agenticmail/tasks/pending?assignee=Bob with Authorization: Bearer ak_alice.
The response is HTTP 200 and includes Bob's task ID and payload: task-for-bob, { "task": "secret task intended for Bob" }.
Alice then sends POST /api/agenticmail/tasks/task-for-bob/complete with her own bearer token and an attacker-controlled result.
The task status becomes completed and the stored result is controlled by Alice.

The local verification command was:

npm run test --workspace=@agenticmail/api -- task-routes-authz.test.ts

Result:

PASS src/__tests__/task-routes-authz.test.ts (1 test)

Expected behavior

Task listing and task mutation endpoints should enforce an authorization relationship between the authenticated caller and the task. For example:

GET /tasks/pending?assignee=<name> should either be restricted to the current agent, master/admin callers, or an explicit delegated relationship.
/tasks/:id/claim, /tasks/:id/result, /tasks/:id/complete, /tasks/:id/fail, and /tasks/:id should verify that the caller is the assignee, assigner, master/admin, or otherwise explicitly authorized.
If capability-based task IDs are retained, the API should not expose those IDs to unrelated agents through the assignee-name listing path.

Credit

Please credit the finder as: Yaohui Wang

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`@agenticmail/api`	all versions	0.9.64

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @agenticmail/api. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update @agenticmail/api to 0.9.64 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hjwc-26pj-v3pm is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-hjwc-26pj-v3pm is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-hjwc-26pj-v3pm. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary A low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to `GET /api/agenticmail/tasks/pending?assignee=<name>`. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (`/tasks/:id/claim`, `/tasks/:id/result`, `/tasks/:id/complete`, `/tasks/:id/fail`) to claim, complete, or fail tasks assigned to a different agent. Because ordinary authenticated agents can discover agent names through `GET /api/agenticmail/accoun

O3 Security · Impact-Aware SCA

Is GHSA-hjwc-26pj-v3pm in your dependencies?

O3 detects GHSA-hjwc-26pj-v3pm across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works