---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enforce Query ACLs for SubLists, List Counts and Widget Data Tables

# Enforce Query ACLs for SubLists, List Counts and Widget Data Tables {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Enforce query ACLs on sublist, list count, and widget data table queries using system properties.
Set com.glide.security.query_acl.enabled.sub_lists to true to enforce query ACLs on sublist queries, such as grouped lists and related lists.

Set com.glide.security.query_acl.enabled.list_count to true to enforce query ACLs on list count queries.

Set glide.security.query_acl.enabled.data_table to true to enforce query ACLs on widget data tables.

If any of these system properties are set to false, an attacker can use blind queries to enumerate and exfiltrate data due to the default behavior of `GlideRecord.addEncodedQuery`. If these
properties don't exist in the System Properties \[sys_properties\] table, the secure default of true is used. A third option, external_and_guests, enforces ACLs only for external users and guests.

Ensure these system properties do not appear in the System Properties \[sys_properties\] table or are set to true.

## More information {#sc-enforce-query-acls-for-sublists-list-counts-and-widget-data-tables__section_qhx_1b1_xwb}

{#sc-enforce-query-acls-for-sublists-list-counts-and-widget-data-tables__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | * com.glide.security.query_acl.enabled.sub_lists * com.glide.security.query_acl.enabled.list_count * glide.security.query_acl.enabled.data_table {#sc-enforce-query-acls-for-sublists-list-counts-and-widget-data-tables__ul_azl_ck1_5fc} |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | * true * true * true {#sc-enforce-query-acls-for-sublists-list-counts-and-widget-data-tables__ul_tnd_hl1_5fc} |
| Default value | * true * true * true {#sc-enforce-query-acls-for-sublists-list-counts-and-widget-data-tables__ul_d3b_3l1_5fc} |
| Fallback value | * true * true * true {#sc-enforce-query-acls-for-sublists-list-counts-and-widget-data-tables__ul_w3z_hl1_5fc} |
| Category | [Architecture, design, and threat modeling](https://servicenow-prod.fluidtopics.net/GP7csKl7x_IoFFA7nE_oew "This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included.") |
| Security risk | * Severity score: 5.3 * CVSS score: Medium * Security Risk: ACLs can be bypassed disclosing field data to users who do not have permissions to see it. This could include sensitive data depending on the table exploited. {#sc-enforce-query-acls-for-sublists-list-counts-and-widget-data-tables__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
[ ]

{#sc-enforce-query-acls-for-sublists-list-counts-and-widget-data-tables__table_ajc_b43_3kb}