CVE-2026-62382

Name of the Vulnerable Software and Affected Versions PasswordPusher versions 1.45.11 through 2.9.5

Description An improper authorization issue exists in the push deletion logic. The system compares @push.user against current user; when a push is created anonymously, both values are nil. Because Ruby evaluates nil == nil as true, the ownership check passes, bypassing the deletable by viewer restriction. This allows an attacker with knowledge of the secret URL to permanently delete an anonymous push, even if the creator disabled viewer deletion or if a passphrase was required. This issue only affects deployments that allow anonymous pushes.

Recommendations Update PasswordPusher to version 2.9.6.