GitLab Users Warned: Leaked Issue Email Lets Attackers Commit Code as You
GitLab provides each user a private email address for filing issues by email, but this address acts as a credential. Anyone who obtains it can email a patch that GitLab commits in the user's name to any branch they can push to, including main, and can start CI/CD jobs as the user. This was highlighted as a security risk.
GitLab’s per-user private email address for filing issues is effectively a silent authentication token. Because it is tied to the user’s account, anyone who obtains that address can submit a patch via email, which GitLab then attributes to the legitimate user. This allows the attacker to push changes to any branch the user can access—including the main branch—and to trigger CI/CD pipelines under the user’s identity. The risk is heightened because such addresses are often embedded in project history, notifications, or support threads, making them easier to leak than passwords. The issue underscores how overlooked “convenience” features can become attack surfaces, especially when they bypass standard authentication checks.
This vulnerability could affect any organization relying on GitLab for collaborative development, particularly open-source projects where multiple contributors share repositories. If exploited, an attacker could inject malicious code or alter build processes, potentially leading to supply-chain compromise or data breaches. The impact may extend to downstream users who trust the integrity of the codebase. However, the actual risk depends on how widely the private email addresses are exposed and whether GitLab enforces additional safeguards like branch protection or two-factor verification. Organizations may need to audit their workflows and consider disabling email-based issue submission if the threat is deemed significant.