The problem

On January 11, 2024, GitLab released 7 patched versions, from 16.1.6 to 16.7.2, for CVE-2023-7028, scored 10.0 out of 10. The advisory: "user account password reset emails could be delivered to an unverified email address." An attacker who sent a reset for your account could receive the link and set a new password.

GitLab told admins how to look for attacks in their logs: requests to /users/password whose email parameter was a JSON array with multiple addresses. The bug came in with 16.1.0 on May 1, 2023, so it was live for eight months. On accounts with two-factor login, the attacker could reset the password but still could not log in.

A researcher reported it through GitLab's bug bounty program. The question behind it fits on one line: who chooses where the reset email goes? A threat model asks such questions on purpose, at design time. Below, you run one on a "forgot password" feature, with STRIDE as the checklist.