GitLab Email Addresses Can Be Weaponized for Supply Chain Attacks

Summary

A security vulnerability has been discovered in GitLab where user-specific incoming email addresses can be weaponized. These email addresses, automatically assigned to each user, contain highly privileged access tokens. Attackers can exploit this by sending specially crafted emails to these addresses, potentially gaining unauthorized access and compromising the supply chain.

Entities