---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Prevent unauthenticated roleless ACL in scripted ACLs
# Prevent unauthenticated roleless ACL in scripted ACLs {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 1 minute to read
The glide.security.allow_unauth_roleless_acl property controls whether scripted Access Control Lists (ACLs) can grant access to unauthenticated users when the ACL is otherwise roleless.
When set to true, ACLs containing script may grant access to unauthenticated users. Setting this property to false prevents unauthenticated users from accessing resources protected by
roleless scripted ACLs.
Confirm that the property glide.security.allow_unauth_roleless_acl is set to false.
## More information {#sc-prevent-unauthenticated-roleless-acl-in-scripted-acls__section_more_info-prevent-unauth-roleless-acl}
{#sc-prevent-unauthenticated-roleless-acl-in-scripted-acls__table_property_details-prevent-unauth-roleless-acl__entry__2}
| Attribute | Description |
|-|-|
| Configuration name | glide.security.allow_unauth_roleless_acl |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | false |
| Fallback value | false |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 7.5 * CVSS rating:High * Security risk details: When set to true, unauthenticated users unauthenticated users can view, create, or delete information that should be restricted to logged-in users. {#sc-prevent-unauthenticated-roleless-acl-in-scripted-acls__sc-sec-risk-prevent-unauth-roleless-acl} |
| Functional impact | When set to true, anonymous or guest visitors bypass login for pages, records, or actions. Setting it to false keeps the login requirement in place for roleless ACLs. |
| Dependencies and prerequisites | None |
[ ]
{#sc-prevent-unauthenticated-roleless-acl-in-scripted-acls__table_property_details-prevent-unauth-roleless-acl}