A security flaw in GitLab's email-to-issue feature allows an embedded token to be used across an entire account, potentially enabling unauthorised code execution.
GitLab has addressed a critical path traversal vulnerability, CVE-2026-85706, which enables unauthenticated attackers to access arbitrary files and secrets.
