Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

GitLab incoming email token auth bypass security flaw

Vulnerability
First reported
Last updated
Happening score
H score 22
2 unique sources, 2 articles

Summary

Hide ▲

GitLab's incoming email token lets a holder act as the account owner, creating unauthorized commit and CI/CD execution risk across projects the user can access. The feature accepts mail from any sender and can turn a message into an issue or a merge request, so a leaked address becomes a reusable credential. Aikido Security showed that the abuse can land code on writable branches, including main, and bypass IP restrictions and 2FA.

Related Happenings

GitLab AI Gateway improper neutralization command execution security flaw (CVE-2026-90970)

Vulnerability
H score35 First: 02.10.2026 19:20 Last: 02.10.2026 19:20 Sources 1

About this happening: GitLab has fixed CVE-2026-90970, a critical improper neutralization flaw in GitLab AI Gateway that could let authenticated users with Duo Agent Platform access...

Open Happening

GitLab CE/EE repository commits API path traversal (CVE-2026-85706)

Vulnerability
H score43 First: 14.09.2026 10:06 Last: 14.09.2026 10:06 Sources 1

About this happening: CISA added CVE-2026-85706 to its actively exploited catalog after GitLab CE/EE servers were probed and attacked, increasing the risk of credential and secret disclosure*...

Open Happening

GitLab repository commits API path traversal vulnerability (CVE-2023-2825)

Vulnerability
H score33 First: 11.09.2026 14:15 Last: 11.09.2026 14:15 Sources 1

About this happening: GitLab has a maximum-severity path traversal vulnerability, CVE-2023-2825, that can let unauthenticated attackers read arbitrary files from vulnerable servers...

Open Happening

GitLab self-managed installations immediate upgrade advisory

Advisory/Mitigation
H score45 First: 11.09.2026 14:15 Last: 11.09.2026 14:15 Sources 1

About this happening: GitLab issued immediate upgrade guidance for self-managed GitLab installations after fixing two security issues in GitLab CE and GitLab EE. Operators were told...

Open Happening

Gitea diffpatch endpoint RCE (CVE-2026-60004)

Vulnerability
H score41 First: 29.07.2026 10:47 Last: 29.07.2026 10:47 Sources 1

About this happening: CVE-2026-60004 is a critical remote code execution flaw in Gitea that lets a user with repository write access run shell commands as the Gitea service account. The...

Open Happening

Timeline

  1. 23.09.2026 19:53 3 articles · 13d ago

    GitLab incoming-email token lets a holder act as the account owner

    Initial Disclosure

    Aikido Security reported that GitLab's incoming-email address behaves like a credential tied to the account: anyone who learns the private address can make GitLab open issues or merge requests, commit patches in the victim's name to writable branches including main, and trigger CI/CD jobs running as that user. Aikido said it first reported the behavior through HackerOne in May 2026 and then filed a confidential issue with GitLab in June, and described the same path as bypassing IP allowlists and working without 2FA on GitLab.com and self-managed instances with incoming email enabled.

    Show sources
    Open in new tab