Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

GitLab incoming email token auth bypass security flaw

Vulnerability
First reported
Last updated
Happening score
H score 18
1 unique sources, 1 articles

Summary

Hide ▲

GitLab's incoming email token lets a holder act as the account owner, creating unauthorized commit and CI/CD execution risk across projects the user can access. The feature accepts mail from any sender and can turn a message into an issue or a merge request, so a leaked address becomes a reusable credential. Aikido Security showed that the abuse can land code on writable branches, including main, and bypass IP restrictions and 2FA.

Related Happenings

GitLab CE/EE repository commits API path traversal (CVE-2026-85706)

Vulnerability
H score43 First: 14.09.2026 10:06 Last: 14.09.2026 10:06 Sources 1

About this happening: CISA added CVE-2026-85706 to its actively exploited catalog after GitLab CE/EE servers were probed and attacked, increasing the risk of credential and secret disclosure*...

Open Happening

GitLab repository commits API path traversal vulnerability (CVE-2023-2825)

Vulnerability
H score33 First: 11.09.2026 14:15 Last: 11.09.2026 14:15 Sources 1

About this happening: GitLab has a maximum-severity path traversal vulnerability, CVE-2023-2825, that can let unauthenticated attackers read arbitrary files from vulnerable servers...

Open Happening

GitLab self-managed installations immediate upgrade advisory

Advisory/Mitigation
H score45 First: 11.09.2026 14:15 Last: 11.09.2026 14:15 Sources 1

About this happening: GitLab issued immediate upgrade guidance for self-managed GitLab installations after fixing two security issues in GitLab CE and GitLab EE. Operators were told...

Open Happening

Gitea diffpatch endpoint RCE (CVE-2026-60004)

Vulnerability
H score41 First: 29.07.2026 10:47 Last: 29.07.2026 10:47 Sources 1

About this happening: CVE-2026-60004 is a critical remote code execution flaw in Gitea that lets a user with repository write access run shell commands as the Gitea service account. The...

Open Happening

GitLab notebook diff authenticated RCE flaw

Vulnerability
H score37 First: 25.07.2026 11:34 Last: 25.07.2026 11:34 Sources 1

About this happening: A public PoC exploit now shows an authenticated RCE path in GitLab that can run commands as git on vulnerable self-managed servers. The flaw affects GitLab CE/EE...

Open Happening

Timeline

  1. 23.09.2026 19:53 2 articles · 2h ago

    GitLab incoming-email token lets a holder act as the account owner

    Initial Disclosure

    Aikido Security reported that GitLab's incoming-email address behaves like a credential tied to the account: anyone who learns the private address can make GitLab open issues or merge requests, commit patches in the victim's name to writable branches including main, and trigger CI/CD jobs running as that user. Aikido said it first reported the behavior through HackerOne in May 2026 and then filed a confidential issue with GitLab in June, and described the same path as bypassing IP allowlists and working without 2FA on GitLab.com and self-managed instances with incoming email enabled.

    Show sources
    Open in new tab