CVE-2021-22249: 
GitLab vulnerability analysis and mitigation

A vulnerability in GitLab Enterprise Edition (EE) affecting all versions since 12.2 was identified where a verbose error message could disclose the private email address of a user invited to a group. The vulnerability was assigned CVE-2021-22249 and was discovered in May 2021 (GitLab Issue).

The vulnerability occurs when domain restrictions are enabled for group memberships. When attempting to invite a user with private email settings to a group with domain restrictions, the system generates an error message that inadvertently reveals the user's private email address. This vulnerability specifically affects GitLab Enterprise Edition installations where group administrators have configured email domain restrictions (GitLab Issue).

The primary impact of this vulnerability is the unauthorized disclosure of users' private email addresses. This breach of privacy affects users who have specifically configured their email addresses to be private, undermining GitLab's privacy controls and potentially exposing sensitive contact information (GitLab Issue).

The issue was reported through GitLab's bug bounty program on HackerOne and subsequently addressed by GitLab. Users are advised to update to a patched version of GitLab Enterprise Edition (HackerOne Report).