CVE-2025-3648
Description
A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them. To assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs. Additionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations. Customers, please review the KB Articles in the References section.
Is your site exposed to CVE-2025-3648?
Run a free security scan — no signup, results in seconds.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2025-3648? +
How do I check if I'm vulnerable to CVE-2025-3648? +
Related Vulnerabilities
Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application …
Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially …
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, …
Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced …
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, …
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS …