Private GitLab email addresses exposed in public documentation

Private GitLab email addresses, used to push issues and tasks to projects, are being exposed in public documentation, according to a recent report by Bleeping Computer.

These email addresses, part of GitLab's "Email work item to this project" feature, contain long-lived tokens that act as credentials. Researchers at Aikido discovered these addresses in READMEs, contributing guides and support pages, warning that attackers could exploit them. By altering the email suffix from "-issue" to "-merge-request", an attacker could potentially create merge requests, compromise accounts, push code to protected branches, steal source code, or access secrets.

User account permissions cannot be bypassed and attackers would need the project's path and ID. For public projects, this information is readily available, and for private projects, the ID can be brute-forced. GitLab's documentation warns users to keep these addresses private, as anyone knowing them can act as the token owner. Aikido reported the issue, and GitLab has since updated its UI and documentation to reflect the risks, including that incoming email bypasses IP restrictions.

Source: Bleeping Computer