diff --git a/app/models/user.rb b/app/models/user.rb
index 01eba7e0426fe74adf7ce3545ca6f0a601bddf01..dbd754dd25a002cd16b123e5b5150cdb8e316af8 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -363,7 +363,7 @@ class User < ActiveRecord::Base
       from_users = from_users.confirmed if confirmed
 
       from_emails = joins(:emails).where(emails: { email: emails })
-      from_emails = from_emails.confirmed if confirmed
+      from_emails = from_emails.confirmed.merge(Email.confirmed) if confirmed
 
       items = [from_users, from_emails]
 
diff --git a/changelogs/unreleased/ce-54109-fix_user_by_any_email.yml b/changelogs/unreleased/ce-54109-fix_user_by_any_email.yml
new file mode 100644
index 0000000000000000000000000000000000000000..7cecbd30dce2c5f84efb8604dccb9714a9f7d6b7
--- /dev/null
+++ b/changelogs/unreleased/ce-54109-fix_user_by_any_email.yml
@@ -0,0 +1,5 @@
+---
+title: User#find_by_any_email to respect confirmed flag on secondary emails
+merge_request: 23181
+author:
+type: fixed
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 733c1c49f0899692b1270ff59a952efb33fcb614..7bd6dccd0ad9e49e1c1c717680ed45a82c6b1bac 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -1137,12 +1137,38 @@ describe User do
       expect(described_class.find_by_any_email(user.email.upcase, confirmed: true)).to eq user
     end
 
-    it 'finds by secondary email' do
-      email = create(:email, email: 'foo@example.com')
-      user  = email.user
+    context 'finds by secondary email' do
+      let(:user) { email.user }
 
-      expect(described_class.find_by_any_email(email.email)).to eq user
-      expect(described_class.find_by_any_email(email.email, confirmed: true)).to eq user
+      context 'primary email confirmed' do
+        context 'secondary email confirmed' do
+          let!(:email) { create(:email, :confirmed, email: 'foo@example.com') }
+
+          it 'finds user respecting the confirmed flag' do
+            expect(described_class.find_by_any_email(email.email)).to eq user
+            expect(described_class.find_by_any_email(email.email, confirmed: true)).to eq user
+          end
+        end
+
+        context 'secondary email not confirmed' do
+          let!(:email) { create(:email, email: 'foo@example.com') }
+
+          it 'finds user respecting the confirmed flag' do
+            expect(described_class.find_by_any_email(email.email)).to eq user
+            expect(described_class.find_by_any_email(email.email, confirmed: true)).to be_nil
+          end
+        end
+      end
+
+      context 'primary email not confirmed' do
+        let(:user) { create(:user, confirmed_at: nil) }
+        let!(:email) { create(:email, :confirmed, user: user, email: 'foo@example.com') }
+
+        it 'finds user respecting the confirmed flag' do
+          expect(described_class.find_by_any_email(email.email)).to eq user
+          expect(described_class.find_by_any_email(email.email, confirmed: true)).to be_nil
+        end
+      end
     end
 
     it 'returns nil when nothing found' do