The address is exposed in the GitLab interface behind a button labeled "Email work item to this project." Mail sent to it opens an issue in the corresponding project, with the message authored as the victim.

Key points:

• The issue-by-email address is effectively a secret credential and should be treated as such.
• A leaked address permits commits to any branch the user can push to, including main.
• It also permits starting CI/CD jobs that run as the affected user.
• GitLab surfaces the address through the "Email work item to this project" button.

Mitigation considerations:

• Treat your project's incoming issue email address as sensitive; avoid sharing it in public channels, screenshots, or documentation.
• Rotate the address if you suspect it has been exposed.
• Review project and branch permissions to limit what a compromised address could reach.

Source: info@thehackernews.com (The Hacker News)

Has your organization reviewed who can access your GitLab issue-by-email addresses?