Exposure of Password Hashes in API Responses in ConnectWise PSA
Discovered by Michael Newton on behalf of The Missing Link Security
Vulnerability Details
In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to encrypted password hashes for other users.
