1 files changed, 13 insertions, 0 deletions
diff --git a/lib/gitlab/email/handler/create_note_handler.rb b/lib/gitlab/email/handler/create_note_handler.rb
index 4fa2fe1724e..b168efaac11 100644
--- a/lib/gitlab/email/handler/create_note_handler.rb
+++ b/lib/gitlab/email/handler/create_note_handler.rb
@@ -24,6 +24,8 @@ module Gitlab
 
           validate_permission!(:create_note)
 
+          validate_from_address!
+
           raise NoteableNotFoundError unless noteable
           raise EmptyEmailError if note_message.blank?
 
@@ -56,6 +58,17 @@ module Gitlab
 
           message_with_appended_reply
         end
+
+        def from_address
+          mail.from&.first
+        end
+
+        def validate_from_address!
+          # Recipieint is always set to Support bot for ServiceDesk issues so we should exclude those.
+          return if author == User.support_bot
+
+          raise UserNotFoundError unless from_address && author.verified_email?(from_address)
+        end
       end
     end
   end