> For the complete documentation index, see [llms.txt](https://docs.sharelogic.com/unifi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sharelogic.com/unifi/troubleshooting/query-range-acl-errors.md).

# Query Range ACL Errors

## Overview

In **May 2025**, ServiceNow applied a **platform-wide security patch** which automatically created additional *Access Control List (ACL)* records on customer instances.

This change unintentionally affected the **ShareLogic Unifi** application by generating dozens of redundant ACLs.

Unifi already enforces strict access control within its own data model. These extra ACLs **do not enhance security**, but they **can block access to transactional data** and cause *query range errors* when using Unifi tables.

***

## Symptoms

You may encounter one or more of the following:

* Error messages such as **“Insufficient query range”** or **“Access denied to table…”**
* Inability to query or list transactional records through Unifi interfaces or APIs
* Unexpected filtering or empty results when viewing Unifi data

***

## Cause

The May 2025 ServiceNow patch created new ACLs in the Unifi scope (`x_snd_eb`) under the system user `@@snc_write_audit@@`. These records override Unifi’s intended access rules.

***

## Resolution

You can safely disable these redundant ACLs. Use the script below to identify and deactivate them.

**Prerequisites**

* `admin` and `security_admin` roles

**Steps**

1. Set the application picker to **ShareLogic Unifi** and choose a suitable update set.
2. Elevated privileges for `security_admin.`
3. Navigate to **System Definition → Scripts - Background**.
4. Paste the following script into the editor.
5. Click **Run Script**.
6. Review the system log for confirmation.
7. Commit or migrate the resulting update set through your normal release process.

```javascript
/**
 * ShareLogic Unifi - Disable unnecessary query_range ACLs
 *
 * In May 2025, ServiceNow deployed a platform-wide security patch which
 * automatically created numerous unnecessary ACLs in the ShareLogic Unifi
 * application. Unifi already implements its own robust access controls, and
 * these additional ACLs provide no further security benefit. Their only effect
 * is to trigger "query range" errors when accessing Unifi tables.
 *
 * Since these ACLs are unique to each instance, you can use this script to
 * disable them and restore Unifi to its intended behaviour.
 *
 * For more information, see:
 * https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2046494
 * https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2130442
 */
(function disableUnifiQueryRangeACLs() {

  // ---- Role checks (fail-fast) ----
  if (!gs.hasRole('security_admin')) {
    gs.debug('Abort: security_admin role is required (elevate privileges first).');
    return;
  }

  var q = new GlideRecord('sys_security_acl');
  q.addQuery('sys_scope', '74f0b4550f8ca20094f3c09ce1050e6a'); // Unifi [x_snd_eb]
  q.addQuery('sys_created_by', '@@snc_write_audit@@');
  q.addQuery('active', true);
  q.query();

  var total = 0, updated = 0, failed = 0;

  while (q.next()) {
    total++;

    q.setValue('active', false);

    if (q.update()) {
      updated++;
    } else {
      failed++;
      gs.debug('Update failed: sys_id=' + sysId + ' (active=' + (v.isValidRecord() ? v.getValue('active') : 'N/A') + ')');
    }
  }

  gs.info([
    'Unifi ACL disable summary:',
    '  total matched: ' + total,
    '  updated: ' + updated,
    '  failed: ' + failed
  ].join('\n'));
})();
```