Sensitive Information Disclosure in ConnectWise PSA Affected by Vulnerability

CVE-2025-7204

What is CVE-2025-7204?

A vulnerability in ConnectWise PSA allows authenticated users to access sensitive user information through specific API requests. This issue manifests in versions prior to 2025.9, where an overly verbose user object may expose encrypted password hashes of other users. This could enable attackers or privileged users to conduct offline brute-force or dictionary attacks, leading to potential credential compromise and unauthorized access to accounts, along with risks of privilege escalation within the system.

References