# Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domain

SCIM provisioning let any group owner create a user with a pre-verified @gitlab.com email, bypassing verification and enabling access to internal GitLab SSO services.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: ngalog
- Disclosed: 2019-08-30
- CVE: CVE-2019-5473
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/565883
- Library page: https://bugbountylibrary.com/r/h1%3A565883
- Tags: area:web domain:web impact:internal-access impact:privesc kind:bounty platform:hackerone sev:medium tech:rest tech:saml vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** SCIM v2 Users API on gitlab.com
**Root cause:** SCIM user creation accepts an arbitrary email value and marks it verified without running the normal email verification flow, trusting attacker-supplied input in a security decision.
**Steps:**
1. Upgrade group plan to gold and configure SAML SSO at `https://gitlab.com/groups/GROUP_PATH/-/saml`
2. Create a SCIM token on the same page
3. Send `POST /api/scim/v2/groups/YOUR_GROUP_NAME/Users` with `Authorization: Bearer YOUR_SCIM_TOKEN` and body containing `"emails":[{"primary":true,"type":"work","value":"ANYGITLABEMAIL@gitlab.com"}]`
4. Open private window and log in via `https://gitlab.com/groups/GROUP_NAME/-/saml/sso?token=xqz82m-b` using the externalId from the POST body
5. Observe logged in as new user with verified @gitlab.com email
**How found:** Researcher noticed the new SCIM provisioning feature let group owners set arbitrary emails and that GitLab marked them verified without the verification flow, then reasoned about IdP consumers that trust email domain.
**Exploitation:** Attacker with group owner rights creates a SCIM user with a victim-domain email (e.g. @gitlab.com), then authenticates as that user via the group SAML SSO link; downstream apps trusting GitLab as IdP and checking email domain grant access.
**Escalation:** Chained with internal GitLab services that use gitlab.com as IdP and gate access on @gitlab.com email domain, yielding access to internal infrastructure.
**Insight:** New provisioning/IdP features (SCIM, SAML) that accept email attributes often skip the normal verification pipeline; test whether created identities are marked verified and whether downstream relying parties trust that flag for domain-based access.