Leaked GitLab email addresses can enable code pushes and CI jobs in a user’s name

GitLab’s issue-by-email address acts as a credential tied to an account. Anyone who obtains it can email a patch that GitLab commits in the user’s name to a branch the user can push to and, where the permissions allow, start CI/CD jobs as that user.