Launchpad.net

CVE 2020-13276

User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1

See the CVE page on Mitre.org for more details.