Improper Authorization Vulnerability in PasswordPusher by P. Glombardo

CVE-2026-62382

What is CVE-2026-62382?

An improper authorization vulnerability exists in PasswordPusher versions v1.45.11 through v2.9.5, specifically in the push deletion logic. This issue arises from a flawed ownership check that compares @push.user to current_user. For pushes created anonymously, both values evaluate to nil, causing the authorization check to incorrectly permit deletion operations. As a result, an attacker who has access to the secret URL can delete an anonymous push, bypassing the restrictions set by the creator, including when viewer deletion is disabled and the passphrase is not provided. Affected deployments are those that allow anonymous pushes, which is the default setting. This vulnerability is addressed in version 2.9.6.

References