---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Restrict access to emails with empty target table

# Restrict access to emails with empty target table {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Activate the glide.email.email_with_no_target_visible_to_all
property to restrict user access to emails, unless they were the one who sent the email or have
an admin role.
If the glide.email.email_with_no_target_visible_to_all system property isn't set to the recommended value of false, then low level users will have access to emails which are not their
own.

Ensure that the property glide.email.email_with_no_target_visible_to_all is set to false.

## More information {#sc-restrict-access-to-emails-with-empty-target-table__section_wc1_cqn_phc}

{#sc-restrict-access-to-emails-with-empty-target-table__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.email.email_with_no_target_visible_to_all |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | \<none\> |
| Fallback value | false |
| Category | [Access control](https://www.servicenow.com/docs/UcoTP53NgzpgtyyAIm1CdQ "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 6.5 * CVSS rating: Medium * Security risk details: Emails that lack a specific target record may become visible to all users, resulting in unauthorized access to potentially sensitive communication and violating principles of least privilege and data confidentiality. {#sc-restrict-access-to-emails-with-empty-target-table__ul_g1g_3sf_xwb} |
| Functional impact | Users are no longer able to see emails where target table is empty unless they are an admin or were the sender of the email. |
| Dependencies and prerequisites | None |
[ ]

{#sc-restrict-access-to-emails-with-empty-target-table__table_ajc_b43_3kb}