Many ticketing systems such as Service-Now are configured by default to accept email that turn into support tickets. It’s best practice to build allow-lists containing your organization’s domains and potentially partners or automated systems. Unfortunately the default state is commonly allow any.
If this is not configured, an organization may find themselves susceptible to an external entity triggering a deluge of P1 (or “Sev 1”) tickets, kicking off notification workflows to large audiences.
This is expensive, demoralizing, and could mask an attack. Dorking for an organizations Service-Now tenant is extremely easy. And many organizations like colleges often publish them on their tech-support portals.
Any notification systems need to be checked for proper access controls including allowed email domains. If this cannot be avoided, it’s best to ensure these senders cannot override the Urgency and Priority.
This is often as simple as:
Impact: 1
Urgency: 1
Word of caution to bug bounty, doing this is usually well out-of-scope and will have business impact.