ConnectWise PSA Sensitive Information Exposure Vulnerability Allowing Credential Theft

A vulnerability in ConnectWise PSA versions prior to 2025.9 allows authenticated users to access sensitive information, specifically encrypted password hashes of other users. This issue arises because certain API requests return excessively detailed user objects that include these hashes. An attacker or privileged user could exploit this by retrieving the exposed hashes and conducting offline brute-force or dictionary attacks, potentially leading to unauthorized account access and privilege escalation within the system.

Impact

Exploitation of this vulnerability could result in unauthorized access to user accounts and elevated privileges within the ConnectWise PSA system.

Remediation

For cloud instances, the latest ConnectWise PSA release is being applied automatically. On-premise users should update to the 2025.9 release and ensure all desktop clients are current.