ServiceNow’s requires_authentication=false: The One Boolean That Exposed Enterprise Data Worldwide

ServiceNow shipped a REST API endpoint (/api/now/related_list_edit/create) with requires_authentication=false, allowing unauthenticated access to customer instance data. Attackers queried IT tickets, employee records, security incident reports, and embedded credentials; anomalous activity and confirmed queries were observed on June 2–3. ServiceNow patched the issue on June 5 after receiving a bug bounty report on April 22 and publicly disclosed the incident on June 9. Organizations are advised to review logs for the endpoint and IP 51.159.98.241, rotate any credentials stored in ServiceNow, and audit Scripted REST Resources for misconfigured authentication.