Sensitive Information Disclosure in ConnectWise PSA Affected by Vulnerability
CVE-2025-7204

6.5MEDIUM

Key Information:

Vendor

Connectwise
Status
Psa
Vendor
CVE Published:
9 July 2025

What is CVE-2025-7204?

A vulnerability in ConnectWise PSA allows authenticated users to access sensitive user information through specific API requests. This issue manifests in versions prior to 2025.9, where an overly verbose user object may expose encrypted password hashes of other users. This could enable attackers or privileged users to conduct offline brute-force or dictionary attacks, leading to potential credential compromise and unauthorized access to accounts, along with risks of privilege escalation within the system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

PSA All versions prior to 2025.9

References

https://www.connectwise.com/company/trust/security-bullet...
vendor-advisory
https://www.themissinglink.com.au/security-advisories/cve...
third-party-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Newton (The Missing Link)
JSON
.