GSD-2022-1002519

In the Google Analytics admin web interface, current as of 2022-05-19 an information leakage exists in the Account Access Management and Property Access Management that can be used, resulting in an attacker determining if a Google-hosted email address is in fact a Google account or a google group, an alias to a user, or a user account. Additionally, if it is an alias Google will report the real email address associated with the alias.

If it's an account it will add it (e.g. kurt@seifried.org).

If it's a google group it will error out with: "Failed to register users" (e.g. group@seifried.org)

If it is an alias, it will error out with "One of the email addresses entered is the alternate email address of a Google Account (e.g. alias@seifried.org). The alternate email address has been changed to that account's primary email address." and it will change the email alias to the correct email.