One fix, and it is a multi-user one.
The control mailbox could be somebody else's. On a server with more than one account, the plugin found its command mailbox by playlist name, and its fallback found it by the machine line with no name at all. Neither checked who owns the playlist. Navidrome applies no filter to getPlaylists for an admin account, so an admin's list holds every playlist of every user, private ones included, and the first mailbox found could belong to another person. Since that playlist is where a NaviBeat client queues commands, an admin could run somebody else's queued command and write the answer back over their mailbox. Both lookups are now filtered by owner, with tests.
Making a new playlist private no longer fails silently. The plugin sets each mix private right after creating it, and the error from that call was discarded outright. It is still not fatal, it is just written to the log now, so a report of mixes appearing on other accounts can be answered instead of guessed at.
Nothing else changed. Upgrading is a straight replacement of the .ndp; your playlists, settings and history are untouched.