GitLab Issue Email Address Leak Enables Unauthorized Code Pushes and CI Job Execution
Private email addresses assigned to GitLab users can be abused to commit code and trigger pipelines as the account owner.
Key Takeaways
- GitLab assigns each user a private email address for email-based issue filing.
- Sending mail to this address can cause GitLab to commit content to the user's repositories in their name.
- Attackers can target any branch the victim can push to, including main.
- CI/CD jobs can be triggered to run as the victim, executing with their permissions.
Related Security News
Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams
Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.
