Incoming email addresses automatically assigned to each user on the platform contain highly privileged access tokens that attackers can use.
GitLab Email Addresses Can Be Weaponized for Supply Chain Attacks
Summary + source link. No paywalls, no tracking.