PT-2026-79549 · Unknown · Password Pusher
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
PasswordPusher versions 1.45.11 through 2.9.5
Description
An improper authorization issue exists in the push deletion logic. The system compares
@push.user against current user; when a push is created anonymously, both values are nil. Because Ruby evaluates nil == nil as true, the ownership check passes, bypassing the deletable by viewer restriction. This allows an attacker with knowledge of the secret URL to permanently delete an anonymous push, even if the creator disabled viewer deletion or if a passphrase was required. This issue only affects deployments that allow anonymous pushes.Recommendations
Update PasswordPusher to version 2.9.6.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Password Pusher