Launchpad.net

CVE 2018-19580

All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made.

See the CVE page on Mitre.org for more details.