Security researchers at Aikido Security have detailed how GitLab's issue-by-email feature creates a serious account takeover risk. Every GitLab account that can use incoming email has a unique address for filing issues; embedded in that address is a token that never expires and is shared across all of the account's projects. GitLab does not verify who actually sends email to that address, so anyone who obtains it can submit issues, merge requests, and even commits under the account owner's identity.
Aikido demonstrated that changing the address's suffix from -issue to -merge-request turns the same token into a way to push code. An attacker can email a patch with a target branch in the subject line, and GitLab will commit that patch to the branch, creating the branch if needed. If the victim's account has sufficient permissions, the patch can alter .gitlab-ci.yml and trigger CI/CD jobs that run as the victim. The researchers also found that incoming email bypasses IP restrictions and two-factor authentication, making it an attractive path even for accounts otherwise strongly protected.
The risk is bounded by the victim's role: a Guest account's leaked token is far less useful than a Maintainer's. Also, GitLab determines the target project using both its path and numeric ID, so an attacker needs those details as well—public projects expose both, and private project IDs are guessable. The Hacker News notes that GitLab changed the address's description text after the report, but the underlying behavior remains unchanged: tokens still do not expire, email senders are still not verified, and individual users have no switch to disable the feature.
GitLab reportedly treats the address as an ordinary leaked credential, while Aikido first reported it in May 2026 and followed up in June. Users can mitigate a known leak by resetting their incoming email token from the profile's personal access tokens page, which invalidates all project addresses at once. Self-managed administrators can disable incoming email entirely, and GitLab has opened an issue about accepting messages only from verified senders, though that change is not yet in place.