Sensitive Information Disclosure in ConnectWise PSA Affected by Vulnerability
CVE-2025-7204

6.5MEDIUM

Key Information:

Status
Vendor
CVE Published:
9 July 2025

What is CVE-2025-7204?

A vulnerability in ConnectWise PSA allows authenticated users to access sensitive user information through specific API requests. This issue manifests in versions prior to 2025.9, where an overly verbose user object may expose encrypted password hashes of other users. This could enable attackers or privileged users to conduct offline brute-force or dictionary attacks, leading to potential credential compromise and unauthorized access to accounts, along with risks of privilege escalation within the system.

Affected Version(s)

PSA All versions prior to 2025.9

References

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Newton (The Missing Link)
.
CVE-2025-7204 : Sensitive Information Disclosure in ConnectWise PSA Affected by Vulnerability