CVE-2026-62382 Overview
CVE-2026-62382 is an improper authorization vulnerability in PasswordPusher, an open-source application for sharing sensitive information through expiring URLs. The flaw resides in the push deletion logic, where the ownership check compares @push.user against current_user. For anonymously created pushes, both values are nil, and Ruby evaluates nil == nil as true. The check passes and the deletable_by_viewer restriction is never enforced. Any attacker who obtains the secret URL can permanently delete an anonymous push, even when the creator disabled viewer deletion and without supplying the passphrase. Only deployments that allow anonymous pushes, which is the default configuration, are affected. The issue is fixed in v2.9.6.
Critical Impact
Attackers with knowledge of a push URL can permanently delete anonymous pushes, bypassing viewer-deletion and passphrase protections and causing loss of shared secrets.
Affected Products
- PasswordPusher v1.45.11 through v2.9.5
- Deployments configured to allow anonymous pushes (default)
- Self-hosted and containerized PasswordPusher instances on the affected versions
Discovery Timeline
- 2026-08-22 - CVE-2026-62382 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-62382
Vulnerability Analysis
The vulnerability is a broken access control flaw classified under CWE-863: Incorrect Authorization. PasswordPusher permits users to create pushes anonymously, without an authenticated account. When a push is created anonymously, the associated user attribute on the push record is stored as nil.
The delete controller enforces ownership by comparing the push owner with the current session user. When an unauthenticated visitor loads the push URL, current_user is also nil. Ruby's equality operator returns true for nil == nil, so the ownership branch succeeds and the request bypasses the secondary deletable_by_viewer policy check. The deletable_by_viewer flag exists precisely to allow creators to restrict deletion, but it is never evaluated when the initial ownership test unintentionally passes.
The result is authorization bypass: any anonymous visitor holding the secret URL can invoke the delete endpoint and destroy the push contents, regardless of the creator's chosen protections.
Root Cause
The root cause is a null-equality logic error in the authorization check. The code assumes @push.user == current_user uniquely identifies an owner, but both operands are nil for anonymous pushes and anonymous viewers. The check therefore conflates "same user" with "no user," granting deletion rights to any visitor.
Attack Vector
The attack requires network access to a vulnerable PasswordPusher instance and knowledge of the secret push URL. No credentials, session, or passphrase are required. An attacker who intercepts, guesses, or otherwise obtains a push URL can issue an HTTP delete request to the push resource. The server treats the request as owner-initiated and removes the push. The passphrase gate that protects push contents is not checked on the delete path, so protected pushes are equally exposed.
See the GitHub Security Advisory GHSA-jf2m-hpj9-4qx2 and the VulnCheck advisory on the null-comparison bypass for additional technical detail.
Detection Methods for CVE-2026-62382
Indicators of Compromise
- HTTP DELETE requests to push endpoints (for example /p/:url_token) originating from unexpected IP addresses or user agents.
- Application logs showing push deletion events without an associated authenticated user identifier.
- Reports from push creators that their pushes disappeared before the configured expiration or view limits were reached.
Detection Strategies
- Review PasswordPusher access logs for delete actions on anonymous pushes and correlate against creator identity.
- Alert on delete requests to push URLs that occur shortly after the URL was generated or shared externally.
- Compare push lifecycle events, specifically creation timestamp against deletion timestamp, to surface premature deletions.
Monitoring Recommendations
- Forward PasswordPusher application and web server logs to a centralized logging platform for retention and search.
- Monitor outbound proxy or WAF telemetry for anomalous DELETE verbs targeting the PasswordPusher hostname.
- Track the running PasswordPusher version across all instances and flag any host still on v1.45.11 through v2.9.5.
How to Mitigate CVE-2026-62382
Immediate Actions Required
- Upgrade PasswordPusher to v2.9.6 or later on all self-hosted and containerized deployments.
- Inventory every running instance and confirm the deployed version matches the fixed release.
- Rotate any secrets that were shared through anonymous pushes on affected versions if unexpected deletions have been observed.
Patch Information
The maintainer resolved the flaw in PasswordPusher v2.9.6. The fix corrects the authorization logic so that the deletion path no longer treats two nil values as a matching owner and properly enforces the deletable_by_viewer setting for anonymous pushes. Refer to the GitHub Security Advisory GHSA-jf2m-hpj9-4qx2 for the release notes and commit references.
Workarounds
- Disable anonymous pushes by requiring authenticated accounts to create pushes until the upgrade is applied.
- Restrict network access to the PasswordPusher instance through VPN or IP allow-listing while the fix is deployed.
- Instruct users to treat shared push URLs as one-time-use and to recreate pushes if a URL may have been exposed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
