CVE-2026-62382 pglombardo CVE debrief

Who should care

Administrators and users of PasswordPusher, especially those allowing anonymous pushes, should be aware of this vulnerability and take steps to mitigate it by reviewing and restricting anonymous push usage, monitoring for suspicious deletion activity, and prioritizing patching to v2.9.6 or later. Vulnerability management and security teams should track exceptions, retest remediated assets, and verify evidence of remediation.

Technical summary

The vulnerability is caused by an improper authorization check in the push deletion logic of PasswordPusher. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, allowing an attacker who knows only the secret URL to permanently delete an anonymous push even when the creator disabled viewer deletion and even without the passphrase. Affected product deployments should prioritize patching to v2.9.6 or later.

Defensive priority

Medium-severity vulnerability in a widely used password management tool; prioritize patching for exposed deployments.

Recommended defensive actions

• Patch to v2.9.6 or later
• Review and restrict anonymous push usage
• Monitor for suspicious deletion activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability affects PasswordPusher versions v1.45.11 through v2.9.5; fixed in v2.9.6. Anonymous push deletion possible due to improper authorization logic. Evidence limits suggest verifying affected deployments, reviewing official advisories, and tracking exposure. Defenders should validate push deletion logic, assess anonymous push usage, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.