CVE-2026-62382: Incorrect Authorization in pglombardo PasswordPusher
Description
PasswordPusher versions 1.45.11 through 2.9.5 have an improper authorization vulnerability in the push deletion logic. The vulnerability allows an attacker who knows the secret URL of an anonymously created push to delete it permanently, bypassing restrictions set by the creator. This occurs because the ownership check incorrectly treats nil values as equal, enabling deletion without authentication or passphrase. The issue affects deployments that allow anonymous pushes, which is the default configuration. The vulnerability is fixed in version 2.9.6.
CVSS v4.0
Score 6.9medium
Affected software
pglombardo
PasswordPusher
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PasswordPusher versions >=1.45.11 and <2.9.6 contain an authorization flaw in the push deletion mechanism. The ownership verification compares @push.user to current_user; for anonymous pushes, both are nil, and Ruby evaluates nil == nil as true, incorrectly granting deletion rights. This bypasses the deletable_by_viewer restriction, allowing attackers with only the secret URL to delete anonymous pushes even if viewer deletion is disabled or no passphrase is known. Only deployments permitting anonymous pushes are vulnerable. The flaw is resolved in version 2.9.6.
Potential Impact
An attacker who knows the secret URL of an anonymously created push can permanently delete that push regardless of the creator's deletion restrictions or passphrase protection. This could lead to loss of sensitive data shared via anonymous pushes. The vulnerability does not require authentication or user interaction and affects only deployments that allow anonymous pushes.
Mitigation Recommendations
Upgrade PasswordPusher to version 2.9.6 or later, where this authorization vulnerability is fixed. Until then, consider disabling anonymous pushes if possible to mitigate risk. Patch status is not explicitly stated as 'official-fix' or 'patchAvailable' but the issue is fixed in version 2.9.6 according to the description.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-13T22:40:54.412Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a899b9bacd9273b49087877
Added to database: 08/22/2026, 12:52:43 UTC
Last enriched: 09/07/2026, 15:35:57 UTC
Last updated: 10/06/2026, 06:48:19 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.