A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You

The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you.

GitLab shows each user this address behind a button labeled “Email work item to this project.” Mail sent to it opens an issue in that project, authored

Source: The Hacker News

Tags:

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

Project Valhalla, Explained: How a Decade of Work Arrives in JDK 28

Project Valhalla, Explained: How a Decade of Work Arrives in JDK 28 Source: Hacker News

Read More

Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication

Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication Read on The Hacker News Source: The Hacker News

Read More

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while

Read More