CVE-2022-4255

Vulnerability

A private email address disclosure vulnerability exists in all versions of GitLab EE from 13.7.0 through 15.4.5, 15.5.0 through 15.5.4, and 15.6.0 through 15.6.0. The issue originates in the group-level webhook event introduced in GitLab EE 13.7 for premium users. When a user is added to a group, the member_added webhook event sends a payload containing the added user's primary email address, even when that email is configured as private (hidden). The official description [1] and the referenced GitLab issue [1] confirm that this leaks the hidden email through the webhook payload.

Exploitation

An attacker does not need any special network position beyond access to the webhook endpoint URL. The attacker must be able to intercept, read, or have access to the HTTP request that GitLab sends to the configured webhook URL when a new member is added to a group. This could be achieved if the webhook URL is controlled by or accessible to an attacker, or if the attacker can observe network traffic to that endpoint (e.g., via a compromised server). No authentication on the attacker's part is required beyond access to the webhook delivery path. The trigger is a legitimate administrative action in GitLab: adding a user to a group, which causes the webhook to fire automatically.

Impact

Successful exploitation allows an attacker to obtain the private (hidden) email address of the user who was added to the group. This information disclosure violates the user's privacy expectation, as the email was deliberately set to private in GitLab. The compromised email can be used for targeted phishing, spam, or to correlate the user's identity across services. The attacker gains no code execution or elevated privileges; the impact is confined to confidentiality loss of a user's hidden email.

Mitigation

GitLab released fixed versions on 2023-01-27: 15.4.6, 15.5.5, and 15.6.1. Users running GitLab EE 13.7 or later should upgrade to one of these patched versions immediately. No workarounds are documented in the available references [1].