PasswordPusher - Information Disclosure (CVE-2026-62382)
Description
PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes and the deletable_by_viewer restriction is never enforced. An attacker who knows only the secret URL can permanently delete an anonymous push even when the creator disabled viewer deletion and even without the passphrase. Only deployments that allow anonymous pushes (the default) are affected. The issue is fixed in v2.9.6.
psychologyCrowdSec Analysis
CVE-2026-62382 is an improper authorization vulnerability in PasswordPusher that affects anonymous pushes when anonymous push creation is enabled. An unauthenticated attacker who knows a push’s secret URL can permanently delete the push without its passphrase, even when viewer deletion has been disabled, causing data loss and service disruption. The vulnerability affects versions v1.45.11 through v2.9.5 and is fixed in v2.9.6.
CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-62382 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers create an anonymous push through POST /p.json with deletable_by_viewer set to false, then use the returned secret token to send an unauthenticated DELETE /p/{url_token}.json request. The deletion succeeds when the response indicates "expired":true and "deleted":true, demonstrating an ownership-check bypass.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-08-22 |
| Rule Released | 2026-09-17 |
Remediation & Protection
External References
- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-jf2m-hpj9-4qx2
- https://www.vulncheck.com/advisories/passwordpusher-before-authentication-bypass-via-null-comparison
- https://tpaidakis.com/writeups/passwordpusher-nil-authorization/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-62382.yaml