GitLab email addresses expose privileged tokens, enabling supply chain attacks

GitLab automatically assigns incoming email addresses to each user that contain highly privileged access tokens. Attackers can weaponize these tokens to compromise accounts and potentially launch supply chain attacks. The vulnerability is confirmed by the source, but exploitation details and affected versions remain unclear.