Masked type variables can be unmasked by non-itil users in Agent Workspace - Known Error

Masked type variables can be unmasked by non-itil users in Agent Workspace Description Masked type variables can be unmasked by non-itil users in Agent Workspace. Even when the 'Request For' is some other user

Steps to Reproduce

1. Hop into any Rome instance and create a catalog item[test item] with masked type variable 2. Submit request for 'test item' from portal [Copy the RITM number] 3. Create a test user [add roles sn_esm_agent,workspace_user] and impersonate this test user 4. Open the RITM copied in step number 2 in native UI and then in Agent workpsace

Actual Behavior: In native UI, "SHOW/HIDE" button for masked type variable is hidden whereas in Agent Workspace "unmask password" button is visible and user is able to unmask the masked type variable. Please see attached screenshot.

Expected Behavior: In native UI, "SHOW/HIDE" button for masked type variable is hidden and in Agent Workspace "unmask password" button should be hidden as well.

Workaround This problem is currently under review. You can contact " http://www.servicenow.com/support/contact-support.html " ServiceNow Technical Support or subscribe to this Known Error article by clicking the Subscribe button at the top right of this form to be notified when more information will become available