Ethical Hacking News
A critical vulnerability has been discovered in GitLab's email-based issue and merge request system, which can be exploited by anyone with the leaked email address. This vulnerability allows attackers to push code, run CI/CD jobs, and access sensitive projects with impunity, posing a significant threat to the security and integrity of user accounts and data.
GitLab's issue and merge request system has a critical vulnerability that allows anyone to access sensitive projects and data.A leaked email address associated with GitLab's issue and merge request system has revealed a digital key that grants the holder access to the user's account.The digital key can be used to email a patch or code change to the address, authoring it as if it were the user's own, and execute arbitrary code on the user's behalf.The vulnerability can be exploited from outside an IP allowlist, and even on instances that require two-factor authentication.GitLab users can reset their incoming email token to mitigate the vulnerability, but should also check for live addresses in their READMEs and contributing guides.Admins on self-managed instances can turn incoming email off to prevent exploitation.
GitLab, a popular version control system, has inadvertently left its users vulnerable to a serious security breach. A leaked email address associated with GitLab's issue and merge request system has revealed a critical flaw that could allow anyone to push code, run CI/CD jobs, and even access sensitive projects with impunity. This revelation has sent shockwaves through the cybersecurity community, with many experts warning of the devastating consequences of this vulnerability.
According to recent reports, the email address in question is a credential that GitLab provides to users when filing issues via email. This address, which looks like it belongs to a single project, actually shares the same token with all the projects a user can access, regardless of whether they are public or private. This token, which does not expire, is essentially a digital key that grants the holder access to the user's account, including their permissions and sensitive data.
The implications of this vulnerability are far-reaching and alarming. Since the email address can be used to create issues and merge requests, anyone who possesses it can email a patch or code change to the address, which GitLab will then commit in the user's name, authoring it as if it were their own. Moreover, the attacker can also start CI/CD jobs that run as the user, effectively allowing them to execute arbitrary code on the user's behalf.
Furthermore, the vulnerability is exacerbated by the fact that GitLab does not check who sent the email, and the token only carries the user's permissions. This means that the attacker's access to the user's account and data will depend on the user's role, which can range from Guest to Maintainer. A leaked address for a Guest account, for example, is nearly useless, while one for a Maintainer can access protected branches and CI/CD secrets.
Another critical aspect of this vulnerability is that it can be exploited from outside an IP allowlist, and even on instances that require two-factor authentication. This means that the attacker can bypass the usual security measures and access the user's account without any further authentication.
So, what can be done to mitigate this vulnerability? According to recent reports, GitLab users can reset their incoming email token by visiting the personal access tokens page in their profile. This reset will replace every project address at once, effectively cutting off the leaked address and preventing further exploitation.
Additionally, users are advised to look through their own READMEs, contributing guides, and support pages for posted addresses, as some of these addresses may be live and can be used to exploit the vulnerability. On a self-managed instance, an administrator can simply turn incoming email off for the whole instance, preventing the vulnerability from being exploited.
In conclusion, the leaked GitLab credential has exposed a critical vulnerability in the company's email-based issue and merge request system. This vulnerability, which can be exploited by anyone with the leaked email address, has the potential to compromise sensitive projects and data, and even allow attackers to execute arbitrary code on behalf of the user. It is essential for GitLab users to take immediate action to mitigate this vulnerability and protect their accounts and data.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Leaked-GitLab-Credential-Exposes-Unprecedented-Vulnerability-in-GitLabs-Email-Based-Issue-and-Merge-Request-System-ehn.shtml
https://thehackernews.com/2026/09/a-leaked-gitlab-issue-email-address.html
Published: Wed Sep 23 13:13:45 2026 by llama3.2 3B Q4_K_M
