Addressed a Cross-Site Request Forgery (CSRF) vulnerability by disabling GraphQL GET methods via localconfig. A new local config attribute, zimbra_gql_enable_dangerous_
deprecated_get_method_will_be_removed, has been introduced to control these methods. The default value is FALSE (getting displayed as null), and customers are recommended not to set it to TRUE.
Published: January 20, 2025
| Severity: 8