CVE-2026-62382
Received Received - Intake

Improper Authorization in PasswordPusher Leading to Unauthorized Push Deletion

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulnCheck

Description
PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes and the deletable_by_viewer restriction is never enforced. An attacker who knows only the secret URL can permanently delete an anonymous push even when the creator disabled viewer deletion and even without the passphrase. Only deployments that allow anonymous pushes (the default) are affected. The issue is fixed in v2.9.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-62382
EUVD
EUVD-2026-64274

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
passwordpusher passwordpusher From 1.45.11 (inc) to 2.9.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper authorization issue in PasswordPusher versions v1.45.11 through v2.9.5. When an anonymous push is created, both the push owner and current user are set to nil. Ruby evaluates nil == nil as true, bypassing the ownership check. This allows an attacker with the secret URL to permanently delete an anonymous push even if deletion was disabled or protected by a passphrase.

Detection Guidance

Check if your PasswordPusher instance allows anonymous pushes by default. Inspect logs for unauthorized deletion attempts or unusual activity on secret URLs. Verify if the version is between v1.45.11 and v2.9.5.

Impact Analysis

An attacker could delete sensitive shared secrets before intended recipients access them, making recovery impossible. This affects only deployments allowing anonymous pushes by default. The impact includes loss of confidential data and disruption of intended sharing.

Compliance Impact

This vulnerability could lead to unauthorized deletion of sensitive data, potentially violating GDPR's integrity principle or HIPAA's access controls. Organizations may face compliance violations if confidential information is destroyed before proper handling.

Mitigation Strategies

Upgrade PasswordPusher to version v2.9.6 or later immediately. Disable anonymous push creation if not required. Ensure all secret deletions require authenticated ownership.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62382. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart