Bottom line: Unauthorized users can now exploit a vulnerability in GitLab's issue filing system to execute malicious code.
What's happening: A leaked email address, previously reserved for GitLab's internal use only, was shared publicly, allowing anyone to send a patch to GitLab's version control system. The address, specifically, is used to file issues via email, and is accessible to all users with a GitLab account. GitLab's security team has confirmed that this address is a credential, and that it allows users to push code and trigger CI/CD jobs as a legitimate user.
What to do: Security teams should immediately review their employees' GitLab access and revoke any unnecessary permissions. They should also consider implementing additional security measures, such as two-factor authentication, to further protect their users' credentials.