The vulnerability involves an authorization bypass that permits an authenticated user to view data in the ServiceNow AI Platform beyond their granted permissions. By exploiting this flaw, the attacker can obtain sensitive information that should be restricted, potentially facilitating further exploitation such as privilege escalation within the system.

All instances of the ServiceNow AI Platform, including both hosted and self-hosted deployments, that have not yet received the update referenced in KB3159623. No specific version identifiers are provided, so any unpatched installation may be affected.

The CVSS score of 8.4 denotes high severity, indicating significant potential for data exposure. The EPSS score of < 1% indicates a very low exploitation probability, although the risk of misuse remains non‑zero. The flaw is not listed in the CISA KEV catalog. The attack vector is inferred to require legitimate user credentials, implying that an authenticated attacker—either a compromised legitimate user or an insider—may abuse the bug. Consequently, the risk is substantial for confidentiality and could serve as a stepping stone to more extensive compromise if access controls are further violated. The potential for further privilege escalation is inferred from the nature of the data access breach, but no specific escalation path is disclosed in the description.