CVE-2026-62382: PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison
PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against currentuser; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes and the deletablebyviewer restriction is never enforced. An attacker who knows only the secret URL can permanently delete an anonymous push even when the creator disabled viewer deletion and even without the passphrase. Only deployments that allow anonymous pushes (the default) are affected. The issue is fixed in v2.9.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PasswordPusherto a version that resolves this vulnerability.Fixed in 2.9.6 - Compensating control
Disable anonymous pushes so that anonymous-created pushes (default deployments that allow anonymous pushes) cannot trigger the authorization bypass in push deletion logic.
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments running PasswordPusher versions v1.45.11 through v2.9.5 are affected only if they allow anonymous pushes, which is the default configuration.
What does an attacker need to delete a protected anonymous push?
An attacker needs only the push's secret URL. They do not need the passphrase, and viewer deletion can be disabled by the creator.
What is the impact of successful exploitation?
An attacker can permanently delete an anonymously created push. The vulnerability bypasses the intended deletion restriction for viewers.
What should be done to remediate the issue?
Upgrade PasswordPusher to v2.9.6. If upgrading cannot happen immediately, disabling anonymous pushes prevents the affected anonymous-push condition.