# CVE-2026-62382: PasswordPusher - Information Disclosure

> Live exploitation tracking for CVE-2026-62382 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-62382

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.9
- **Public exploit available:** Yes
- **Affected products:** Pglombardo PasswordPusher
- **Weaknesses:** CWE-863 (Incorrect Authorization)
- **Tags:** web_application

## Description

PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes and the deletable_by_viewer restriction is never enforced. An attacker who knows only the secret URL can permanently delete an anonymous push even when the creator disabled viewer deletion and even without the passphrase. Only deployments that allow anonymous pushes (the default) are affected. The issue is fixed in v2.9.6.

## CrowdSec analysis

[CVE-2026-62382](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-62382) is an improper authorization vulnerability in PasswordPusher that affects anonymous pushes when anonymous push creation is enabled. An unauthenticated attacker who knows a push’s secret URL can permanently delete the push without its passphrase, even when viewer deletion has been disabled, causing data loss and service disruption. The vulnerability affects versions v1.45.11 through v2.9.5 and is fixed in v2.9.6.

CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-62382 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers create an anonymous push through `POST /p.json` with `deletable_by_viewer` set to `false`, then use the returned secret token to send an unauthenticated `DELETE /p/{url_token}.json` request. The deletion succeeds when the response indicates `"expired":true` and `"deleted":true`, demonstrating an ownership-check bypass.

## Timeline

- 2026-08-22: CVE Published. CVE-2026-62382 is published to NVD.
- 2026-09-17: Rule Released. CrowdSec releases a rule to detect CVE-2026-62382 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-jf2m-hpj9-4qx2
- https://www.vulncheck.com/advisories/passwordpusher-before-authentication-bypass-via-null-comparison
- https://tpaidakis.com/writeups/passwordpusher-nil-authorization/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-62382.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-62382) follows observed exploitation activity for CVE-2026-62382. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.