CVE-2026-62382 pglombardo CVE debrief

Who should care

Defenders of PasswordPusher deployments, especially those allowing anonymous pushes, should assess exposure and prioritize remediation. This includes reviewing current deployment configurations, verifying affected versions, and upgrading to v2.9.6 or later. Security teams and operators managing PasswordPusher should also review authentication and authorization settings to prevent unauthorized push deletions.

Why it matters

CVE-2026-62382's improper authorization vulnerability in PasswordPusher allows unauthorized deletion of anonymous pushes. Defenders of deployments allowing anonymous pushes should verify exposure, restrict access, and upgrade to v2.9.6. The impact includes potential data loss and exposure through secret URL enumeration. Remediation priority is high for affected deployments.

• Potential for unauthorized push deletion, leading to data loss.
• Exposure of sensitive information through secret URL guessing or enumeration.
• Need for verification of affected versions and deployment configurations.
• Priority for upgrading to a fixed version to prevent exploitation.

Technical summary

The vulnerability is due to an improper authorization check in the push deletion logic of PasswordPusher. The check compares @push.user against current_user, and for anonymously created pushes, both values are nil, causing the check to pass and the deletable_by_viewer restriction to be ignored. This allows an attacker who knows the secret URL to permanently delete an anonymous push, even if the creator disabled viewer deletion and without the passphrase.

Defensive priority

Defenders should prioritize verifying affected deployments, restricting anonymous push access, and upgrading to v2.9.6.

Recommended defensive actions

• Verify if the deployment allows anonymous pushes and restrict access if necessary.
• Upgrade to PasswordPusher v2.9.6 or later.
• Monitor push deletion logs for unauthorized activity.
• Review and adjust the deployment's authentication and authorization settings.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in PasswordPusher versions v1.45.11 through v2.9.5, with the fix in v2.9.6. Official sources and vendor advisories corroborate the issue. Evidence limits are based on public CVE details and vendor guidance. Defenders should verify affected versions, review deployment configurations, and upgrade to v2.9.6 or later. The CVE Program and NIST NVD provide additional context and severity assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.