Executive Summary
Research by Aikido Security has revealed that GitLab's 'Email work item' feature utilizes a long-lived, non-expiring token that serves as an account-wide credential. While presented in the UI as a scoped mechanism for filing issues, the embedded token (often prefixed with 'glimt-') actually grants the holder authorization to perform significant actions across all projects the victim can access, including private repositories.
Technically, an attacker who obtains this token can modify the email address suffix from '-issue' to '-merge-request' and attach a git .patch file. GitLab processes these emails without verifying the 'From' address, effectively allowing an attacker to push code to any branch (including main) and trigger CI/CD pipelines as the victim. Crucially, this vector bypasses traditional security boundaries such as two-factor authentication (2FA) and IP allowlists, as inbound email processing is exempt from these restrictions.
The business impact is high; a leaked token from a user with Maintainer permissions could lead to full repository compromise, secret exfiltration, and supply chain attacks via malicious code injection. Organizations using GitLab.com or self-managed instances with incoming email enabled are affected and should immediately review their exposure.