User is unable to see some records in Vulnerable item table, those are assigned to him

[SamharaM2575]

Description: roles are present, but security attribute blocked to access records in vulnerable items
Part of the query on sn_vul_vulnerable_item has been ignored because of insufficient access for 'query_range' operation on sn_vul_vulnerable_item.assigned_to

Part of the query on sn_vul_vulnerable_item has been ignored because of insufficient access for 'query_range' operation on sn_vul_vulnerable_item.assigned_to

[brianlan25]

Sound like you are missing a query_range ACL. If you do not have any custom ACLs then I would suggest putting in support case to see why you don't have an out of the box query_range ACL.

[Sachin_Nasa]

Hi @SamharaM2575 ,
It looks like the user has access to the sn_vul_vulnerable_item table but is missing permission on the assigned_to field during query execution.

In Vulnerability Response, when a user filters records (for example Assigned to = Me), ServiceNow evaluates not only the table ACL but also the field-level ACL for query/query_range. If the ACL on sn_vul_vulnerable_item.assigned_to is restrictive (role, condition, script, or security attribute), part of the query gets ignored and the assigned records may not be visible.

I would check:

• Field ACLs on sn_vul_vulnerable_item.assigned_to (read, query, query_range)

• Any script/condition in those ACLs

• Security Attributes or data segregation used in Vulnerability Response

• Whether the user has appropriate roles like sn_vul_user / sn_vul_analyst

Impersonating the user and enabling Debug Security Rules should show which ACL is blocking the query.

It seems like the table access is available, but the field/query_range ACL is more restrictive, which is causing this behavior.


Please let me know if this helps. If it addresses your requirement, kindly mark it as helpful and accept it as the solution.