---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Deny unauthorized access to request items

# Deny unauthorized access to request items {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The glide.sc.req_for.roles.default property defines a default
behavior for the retrieveAddress API.
The glide.sc.req_for.roles.default system property defines a default behavior for the retrieveAddress API. When there are no roles given in the
glide.sc.req_for.roles property, the client callable script include ScriptServiceCatalogGetLocation can be called by any unprivileged logged-in user and can retrieve the address of
any other users in the system.

Ensure that the property glide.sc.req_for.roles.default is set to <kbd class="ph userinput">deny</kbd>.

## More information {#sc-deny-unauthorized-access-to-request-items__section_wc1_cqn_phc}

{#sc-deny-unauthorized-access-to-request-items__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.sc.req_for.roles.default |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String |
| Recommended value | deny |
| Default value | \<none\> |
| Fallback value | deny |
| Category | [Access control](https://www.servicenow.com/docs/UcoTP53NgzpgtyyAIm1CdQ "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 4.2 * CVSS rating: Medium * Security risk details: If glide.sc.req_for.roles.default is not set to the recommended value of <kbd class="ph userinput">deny</kbd> and the value of glide.sc.req_for.roles is empty, then any user can request items for other users allowing unauthorized resource access. {#sc-deny-unauthorized-access-to-request-items__ul_g1g_3sf_xwb} |
| Functional impact | None |
| Dependencies and prerequisites | None |
[ ]

{#sc-deny-unauthorized-access-to-request-items__table_ajc_b43_3kb}