Over 1,000 ServiceNow instances found leaking corporate KB data

AppOmni researchers discovered more than 1,000 misconfigured ServiceNow instances exposing Knowledge Base articles that contain sensitive corporate information — including PII, internal system details, and active credentials/tokens. They demonstrated a proof-of-concept using token interception, public widgets, and brute-forcing incremental KB IDs (KBXXXXXXX) to retrieve articles without authentication; ServiceNow has provided guidance and mitigation actions, but many KBs remain at risk due to reliance on User Criteria instead of ACLs.