ServiceNow AI Platform suffers from a domain separation bypass that allows an authenticated user with a privileged role to create records in domains they normally lack access to. This bug enables the creation of unauthorized data across domain boundaries, potentially affecting the confidentiality and integrity of information stored in those domains. The issue is classified under CWE‑284 due to improper access control.

The vulnerability has been identified in the ServiceNow SR–CSM–Task Plan Templates Store application, part of the ServiceNow AI Platform. No specific version information is provided, so all installs of the affected application are considered potentially impacted.

The CVSS score of 5.3 indicates a medium severity flaw. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Exploitation requires an authenticated user already possessing a specific role, making the attack vector internal. As such, the risk is moderate and depends on the privilege scope of relevant accounts.