I got hit by this, we also noticed it being used with a second “feature” that exposed us a bit more than it should have. Basically a requirement for this attac

I got hit by this, we also noticed it being used with a second “feature” that exposed us a bit more than it should have. Basically a requirement for this attack is to know the email of the user you want to reset, but, there is a hidden email address that is tied to your gitlab userid (a number incrementing from 1). Since its a safe bet that ID 1 or 2 is an admin: thats a good target. the email is something like 1-user@mail.noreply.<gitlabhost>. Really bad, seemed like it was automated. 2FA saved us here.