Thousands of orgs at risk of knowledge base data leaks via ServiceNow misconfigurations

Security researchers disclosed that ServiceNow Knowledge Base widgets can be misconfigured such that 'private' KB articles are retrievable by unauthenticated actors: the KB Article Page widget permits enumeration of predictable article IDs (KBXXXXXXX) and, with the g_ck JavaScript token, an attacker can POST requests to obtain full article content. Estimates suggest a large portion of ServiceNow instances (roughly 30–45%) were vulnerable; mitigations include applying proper User Criteria, ensuring relevant Business Rules are active, and following ServiceNow's guidance and proactive configuration fixes.