Restrict access to emails with empty target table
Activate the glide.email.email_with_no_target_visible_to_all property to restrict user access to emails, unless they were the one who sent the email or have an admin role.
If the glide.email.email_with_no_target_visible_to_all system property isn't set to the recommended value of false, then low level users will have access to emails which are not their own.
Ensure that the property glide.email.email_with_no_target_visible_to_all is set to false.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.email.email_with_no_target_visible_to_all |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | false |
| Default value | <none> |
| Fallback value | false |
| Category | Access control |
| Security risk | - Severity score: 6.5 - CVSS rating: Medium - Security risk details: Emails that lack a specific target record may become visible to all users, resulting in unauthorized access to potentially sensitive communication and violating principles of least privilege and data confidentiality. |
| Functional impact | Users are no longer able to see emails where target table is empty unless they are an admin or were the sender of the email. |
| Dependencies and prerequisites | None |
Parent Topic:Access control