Vulnerability · Published Aug 22, 2026 · Assigned by VulnCheck
CVE-2026-62382PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison
Medium 6.9
In plain English
A medium-severity incorrect authorization in PasswordPusher from pglombardo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes and the deletable_by_viewer restriction is never enforced. An attacker who knows only the secret URL can permanently delete an anonymous push even when the creator disabled viewer deletion and even without the passphrase. Only deployments that allow anonymous pushes (the default) are affected. The issue is fixed in v2.9.6.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pglombardo | PasswordPusher | 0 – before 2.9.6 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
References
- GitHub Security Advisory (GHSA-jf2m-hpj9-4qx2) vendor-advisory
- Researcher Blog technical-description, exploit
- VulnCheck Advisory: PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison third-party-advisory