# Ability To Delete User(s) Account Without User Interaction

Spoofed emails to gdpr-request@gitlab.com triggered account deletion without identity verification, letting an attacker delete any user's GitLab account.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: hx01
- Disclosed: 2021-03-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/928255
- Library page: https://bugbountylibrary.com/r/h1%3A928255
- Tags: area:web domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:email vuln:auth-bypass vuln:business-logic vuln:misconfiguration

**Target:** GDPR request email intake (gdpr-request@gitlab.com)
**Root cause:** GitLab's GDPR access/deletion workflow trusts the From address of incoming email and performs no identity verification (DOB/ID) before acting on deletion requests.
**Steps:**
1. Send a spoofed email from the victim's address to `gdpr-request@gitlab.com` via a reputable SMTP relay (e.g. Sendgrid).
2. Victim receives a confirmation email from GitLab.
3. Within days GitLab deletes the victim's account.
**How found:** Researcher reasoned about GitLab's GDPR email-based rights workflow and noticed no security question or sender authentication was enforced before deletion.
**Exploitation:** Attacker spoofs the victim's email address and submits a GDPR deletion request; GitLab processes it without authenticating the sender or verifying identity, deleting the account.
**Insight:** Email-based GDPR/data-rights intake addresses are an unauthenticated account-deletion surface: test whether the org verifies sender identity or requires a security question before acting on spoofable requests.