CVE-2025-7204 Exposure of password hashes via API responses in ConnectWise PSA
Authenticated users can retrieve other users' password hashes via verbose API responses, enabling offline attacks and potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-7204?
CVE-2025-7204 is a medium-severity vulnerability in ConnectWise PSA, published on 9 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encrypted password hashes for other users. Authenticated users could then retrieve these hashes.
An attacker or privileged user could then use these exposed hashes to conduct offline brute-force or dictionary attacks. Such attacks could lead to credential compromise, allowing unauthorized access to accounts, and potentially privilege escalation within the system.
Weakness: CWE-201
Which versions are affected by CVE-2025-7204?
It affects 1 product.
Products include Connectwise Professional Service Automation.
How do I fix CVE-2025-7204?
No fix has been published for CVE-2025-7204 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-7204 being exploited?
There is no known exploitation of CVE-2025-7204 in the wild and no public exploit code.
Other vulnerabilities in ConnectWise PSA
Sources
Also known as GHSA-v9mv-65w9-g7fv.