As far as I can tell, it requires forcing GitLab to render a malicious org-mode file. I don't really see a way to do that without authenticating and uploading one. Am I missing something?

    The attack needs no authentication — only one public project that can hold the .org payload.