Data Exposure Misconfiguration Issue in ServiceNow

On October 18, 2023 ServiceNow published guidance after AppOmni disclosed a misconfiguration in Access Control Lists (ACLs) where ACLs with no role, condition, or script combined with a public SimpleListWidget can allow unauthenticated actors to read specific tables and potentially exfiltrate sensitive data; ServiceNow provided detection and remediation steps (e.g., add gs.isLoggedIn() to ACL scripts) and additional hardening recommendations.