In brief: The “City-Forum” campaign exploits misconfigured access permissions in Salesforce Experience Cloud and ServiceNow portals to automatically scrape publicly accessible data using purpose-built tools.
An active attack campaign codenamed “City-Forum” uses purpose-built tools to harvest data that is inadvertently accessible to anonymous users via Salesforce Experience Cloud and ServiceNow customer portals.
Security researchers have identified an ongoing campaign focused on customer portals belonging to Salesforce Experience Cloud and ServiceNow. The attackers are using custom-built tools to extract information that is publicly retrievable without authentication due to misconfigurations of these portals. The campaign is internally referred to as “City-Forum”.
Both platforms allow organizations to set up self-service portals for customers, partners, or the public. If access permissions for objects, records, or fields are not correctly restricted, content that should be reserved for logged-in users only can also become accessible anonymously. The campaign exploits exactly this gap to harvest sensitive datasets at scale.
For CISOs, this means the attack surface does not end with their own infrastructure but begins with the configuration of SaaS platforms, which are often operated by business units without direct involvement of the security department. Misconfigured permissions in Salesforce Experience Cloud or ServiceNow portals are a well-known but often underestimated risk, since the platforms themselves do not need to be compromised — the data is already exposed.
Affected organizations should review the access controls of their publicly reachable Salesforce and ServiceNow portals, in particular guest user permissions, sharing rules, and field-level security. A systematic inventory of all externally accessible portals along with regular configuration audits reduces the risk of unknowingly becoming a target of such automated data-scraping operations.
Source: www.bleepingcomputer.com · Published August 13, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.