important · Edge — GitLab
One GitLab issue-by-email address can become account-wide repository and CI authority.
Affects
GitLab.com and GitLab Self-Managed source-code hosting and CI/CD installations with incoming email enabled.
The address embeds a non-expiring account-wide token. Changing its suffix to the merge-request route and attaching a patch can create commits as the owner, modify CI and operate outside project IP restrictions.
Detail and 3 sources
GitLab changed its wording but left the underlying token and sender-handling mechanism intact.