Part 2: Can Just Anyone Access Your ServiceNow Articles?

This report details a ServiceNow widget misconfiguration that permits unauthenticated access to Knowledge Base articles by calling widget endpoints with article identifiers and session/token values, demonstrating step-by-step exploit requests, how to scale the technique to enumerate all public articles, prevalence across customer instances, and recommended remediation steps to make knowledge bases and public pages private.