Because these email addresses can be used to push code and create issues or tasks, their exposure gives attackers a potential path into projects that rely on them. The exposure appears to stem from the addresses being published openly in documentation and support channels rather than through any single flaw in GitLab itself.

• Affected locations include READMEs, contributing guides, and support pages used for bug reports
• The exposed addresses can be used to push issues or tasks to a project

If your organization uses GitLab project email addresses for issue or task submission, it is worth reviewing your public documentation and support pages to confirm these addresses are not exposed where they should remain private.

Source: BleepingComputer

Have you checked whether your project's private GitLab email addresses are leaking in public documentation or support pages?