The Hacker News(@TheHackersNews):‼️ You can commit code to a GitLab repo by emailing it. Every GitLab user gets a private address for filing issues. Hidden inside is a non-expiring account token. If that address leaks, someone can send a patch that GitLab commits as you and, with your permissions, target main or trigger CI/CD. Incoming email also bypasses 2FA and IP restrictions. Read:

The Hacker News

@TheHackersNews

The #1# trusted source for cybersecurity news, insights, and analysis — built for defenders and trusted by decision-makers.

Joined October 2010

2K Following 2.4M Followers

The Hacker News@TheHackersNews

2026.09.23 16:54

‼️ You can commit code to a GitLab repo by emailing it. Every GitLab user gets a private address for filing issues. Hidden inside is a non-expiring account token. If that address leaks, someone can send a patch that GitLab commits as you and, with your permissions, target main or trigger CI/CD. Incoming email also bypasses 2FA and IP restrictions. Read: