CVE-2025-7204 json
Exposure of password hashes via API responses in ConnectWise PSA
published 2025-07-09 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-20827
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encrypted password hashes for other users. Authenticated users could then retrieve these hashes.
An attacker or privileged user could then use these exposed hashes to conduct offline brute-force or dictionary attacks. Such attacks could lead to credential compromise, allowing unauthorized access to accounts, and potentially privilege escalation within the system.
Patch / fix
- connectwise professional_service_automation 2025.9
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 16 mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected products
- ConnectWise PSA
Classification
- Weakness
-
- CWE-201 Insertion of Sensitive Information Into Sent Data
References
-
connectwise.com
/company/trust/security-bulletins/connectwise-psa-2025.9-security-fix
vendor-advisory
-
themissinglink.com.au
/security-advisories/cve-2025-7204
third-party-advisory
Sources
- CVE List CVE-2025-7204
- NVD CVE-2025-7204
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.