A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You

GitLab provides each user a private email address for filing issues by email, but this address functions as a credential. If this address is leaked or discovered by a malicious actor, they can send emails that GitLab will commit as code patches in the victim's name to any branch the victim has push access to, including main/master branches. Additionally, attackers can trigger CI/CD pipeline jobs that execute under the victim's identity and permissions. The vulnerability stems from the fact that GitLab trusts the destination email address as sufficient authentication for performing sensitive repository operations. This represents a significant privilege escalation and identity impersonation risk within GitLab-hosted projects. The feature, labeled 'Email work item to this project,' is intended for convenience but inadvertently exposes users to serious security risks if the address is exposed in logs, forwarded emails, or other leakage vectors.