GitLab security flaw allows code injection via issue email addresses

Researchers at Aikido Security have identified a significant security flaw in GitLab’s ‘Email work item to this project’ feature. The vulnerability stems from the fact that the unique email address assigned to users for creating issues contains an account-wide access token, identifiable by the prefix ‘glimt-’.

While GitLab presents these addresses as project-specific contact points, the underlying token is actually tied to the user's entire account and does not expire. Because GitLab does not verify the sender's email address, anyone who obtains this address can send emails that GitLab processes as if they were sent by the legitimate account owner.

An attacker with access to this address can bypass security measures such as two-factor authentication and IP allowlists. By sending a specifically formatted email with a patch attachment and a target branch like ‘main’ in the subject line, an attacker can push code to protected branches and trigger CI/CD jobs under the victim's identity.

GitLab has reportedly classified this behavior as intended rather than a bug, closing the report in May and opting to update its documentation instead of issuing a patch.