4 ms·
My god I read up a little on the vulnerability and it might have been written as a feature to recover your account with any email address?? The module was calle
by treflop 2y ago
My god I read up a little on the vulnerability and it might have been written as a feature to recover your account with any email address?? The module was called RecoverableByAnyEmail or something.
- thedanbob 2y agoThe intention was "any email associated with the user". You submitted an email address, Gitlab looked up the account associated with it, then sent the reset email to the supplied address. The issue was they didn't consider what would happen if you submitted an array of emails.