CVE-2018-19580
All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made.
Date published : 2019-07-10
https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/