Sensitive Information Disclosure in ConnectWise PSA Affected by Vulnerability
CVE-2025-7204
6.5MEDIUM
What is CVE-2025-7204?
A vulnerability in ConnectWise PSA allows authenticated users to access sensitive user information through specific API requests. This issue manifests in versions prior to 2025.9, where an overly verbose user object may expose encrypted password hashes of other users. This could enable attackers or privileged users to conduct offline brute-force or dictionary attacks, leading to potential credential compromise and unauthorized access to accounts, along with risks of privilege escalation within the system.
Affected Version(s)
PSA All versions prior to 2025.9