On live feed shown on an incident, the trash can icon is always visible on all messages from all users, giving the impression anyone can delete anyone else's posts.

If, for example, an itil user tries to delete a previous post from an admin, a message appears to confirm deletion, and allows the post after confirmation.

After refreshing the parent incident form however, the live feed message appears again, so the delete operation did not actually occur.

 

1. Login a demo instance as admin
2. Open an existing incident and take note of its number
3. Click Show live feed icon
4. Type a new comment and work note, and click Post
5. Verify the incident now shows the post in the activity log
6. Impersonate an itil user
7. Open the same incident in step 2
8. Click Show live feed icon
9. Observe the trash can icon becomes available on previous posts from admin, or other users, and click on it
10. Confirm the alert message to actually delete and observe the post disappears
11. Refresh the parent incident form
12. Click icon and observe the previous post has actually not been deleted

 

After carefully considering the severity and frequency of the issue, and risk of attempting a fix, it has been decided to not address this issue in any current or future releases. We do not make this decision lightly, and we apologize for any inconvenience. If you have any questions regarding this problem, contact ServiceNow Customer Support.