CVE-2026-62382— PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison
Quick assessment
Affected
pglombardo PasswordPusher
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PasswordPusher v1.45.11 至 v2.9.5 版本中存在一个不当授权漏洞，该漏洞出现在推送（push）删除逻辑中。所有权检查会将 @push.user 与 current_user 进行比较；对于匿名创建的推送，这两个值均为 nil，而 Ruby 语言中 nil == nil 的结果为 true，因此该检查会通过，导致 deletable_by_viewer（允许查看者删除）的限制从未被强制执行。攻击者即使仅知道秘密链接，也能永久删除匿名推送，即使创建者已禁用查看者删除功能，且无需知晓通行短语（
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| pglombardo | PasswordPusher | < 2.9.6 |
affected |
2.9.6 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-62382
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison
Source: CVE Program / CVE List V5
Vulnerability Description
PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes and the deletable_by_viewer restriction is never enforced. An attacker who knows only the secret URL can permanently delete an anonymous push even when the creator disabled viewer deletion and even without the passphrase. Only deployments that allow anonymous pushes (the default) are affected. The issue is fixed in v2.9.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| pglombardo | PasswordPusher | 0 ~ 2.9.6 | - |
|
II. Public POCs for CVE-2026-62382
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-62382
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-62382 (1)
Other References for CVE-2026-62382 (1)
IV. Related Vulnerabilities
Same product: PasswordPusher
-
CVE-2026-61458
PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottle -
CVE-2026-59802
PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in -
CVE-2026-41308
Password Pusher: JSON API `/p.json` file upload alias bypass -
CVE-2024-56733
Password Pusher Allows Session Token Interception Leading to -
CVE-2024-52796
Password Pusher's rate limiter can be bypassed by forging pr
Same vendor: pglombardo
-
CVE-2026-61458
PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottle -
CVE-2026-41308
Password Pusher: JSON API `/p.json` file upload alias bypass -
CVE-2024-56733
Password Pusher Allows Session Token Interception Leading to -
CVE-2024-52796
Password Pusher's rate limiter can be bypassed by forging pr -
CVE-2024-51989
Cross-site Scripting (XSS) Vulnerability in PasswordPusher
Same weakness: CWE-863
-
CVE-2026-60083
SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file -
CVE-2026-4245
Post Duplicator <= 3.0.11 - Authorization Bypass to Authenti -
CVE-2026-77234
Improper input validation in FreeRTOS-Kernel timer command h -
CVE-2026-62941
Incus: Cross-project instance copy bypasses target project r -
CVE-2026-62313
Incus: Project restriction `restricted.containers.privilege=
V. Comments for CVE-2026-62382
No comments yet