CVE-2020-13265: 
GitLab vulnerability analysis and mitigation

A user email verification bypass vulnerability was discovered in GitLab CE/EE versions 12.5 through 13.0.1, identified as CVE-2020-13265. The vulnerability was reported on December 20, 2019, and was patched in the security release on May 27, 2020. This security issue affected both GitLab Community Edition (CE) and Enterprise Edition (EE) installations (GitLab Release).

The vulnerability allowed users to bypass the email verification process in GitLab. The exploit involved registering an account with any email address, including those with the gitlab.com domain, without proper verification. Users could then change their email settings and manipulate the verification system to get both the original and new email addresses marked as verified (GitLab Issue).

The vulnerability allowed attackers to verify any email address on gitlab.com, including those with the gitlab.com domain. This could potentially lead to impersonation of GitLab employees or other users, as attackers could set verified gitlab.com email addresses as their primary email addresses (GitLab Issue).

The vulnerability was demonstrated to be exploitable through a simple process of account creation and email manipulation. The proof of concept showed that attackers could bypass email verification controls by following a specific sequence of actions in the GitLab user interface (GitLab Issue).

The vulnerability was addressed in GitLab versions 13.0.1, 12.10.7, and 12.9.8. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately. The fix was implemented as part of a security release that addressed multiple vulnerabilities (GitLab Release).