Attention all ServiceNow users leveraging the Employee Relations plugin!
We've identified a potential data leak risk that could compromise sensitive information. While the Employee Relations plugin restricts access to Evidence records based on the associated ER case permissions, a critical vulnerability exists.
Here's the issue:
- When you attach files to Evidence records, these files are accessible to Admin users who may not have access to the corresponding ER case.
- This means that sensitive information related to confidential cases could potentially be exposed to unauthorized personnel.
We will report this issue to Now Support and encourage you to share this information with your colleagues and work together to ensure the security of your ServiceNow instance.
