Theopaid

**Name of the Vulnerable Software and Affected Versions** PasswordPusher versions 1.45.11 through 2.9.5 **Description** An improper authorization issue exists in the push deletion logic. The system compares `@push.user` against `current user`; when a push is created anonymously, both values are nil. Because Ruby evaluates `nil == nil` as true, the ownership check passes, bypassing the `deletable by viewer` restriction. This allows an attacker with knowledge of the secret URL to permanently delete an anonymous push, even if the creator disabled viewer deletion or if a passphrase was required. This issue only affects deployments that allow anonymous pushes. **Recommendations** Update PasswordPusher to version 2.9.6.