CVE-2026-62382

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62382
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62382.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62382
Aliases
  • GHSA-jf2m-hpj9-4qx2
Published
2026-08-22T12:26:45Z
Modified
2026-09-25T03:31:00Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison
Details

PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes and the deletable_by_viewer restriction is never enforced. An attacker who knows only the secret URL can permanently delete an anonymous push even when the creator disabled viewer deletion and even without the passphrase. Only deployments that allow anonymous pushes (the default) are affected. The issue is fixed in v2.9.6.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62382.json"
}
References

Affected packages

Git / github.com/pglombardo/passwordpusher

Affected ranges

Type
GIT
Repo
https://github.com/pglombardo/passwordpusher
Events
Introduced
dc11679423be9b785e922cb71c90133490593b4b
Fixed
f305ac962b9ff5f849ef306c4b7eda3bfdb5115f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.9.6"
        },
        {
            "introduced":  "v1.45.11"
        },
        {
            "fixed":  "v2.9.5"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

Other
stable
v1.*
v1.45.11
v1.46.0
v1.46.1
v1.46.2
v1.46.3
v1.47.0
v1.47.1
v1.47.2
v1.47.3
v1.47.4
v1.48.0
v1.48.1
v1.48.2
v1.49.0
v1.49.1
v1.49.2
v1.49.3
v1.49.4
v1.50.0
v1.50.1
v1.50.10
v1.50.11
v1.50.12
v1.50.13
v1.50.14
v1.50.15
v1.50.16
v1.50.17
v1.50.18
v1.50.2
v1.50.3
v1.50.4
v1.50.5
v1.50.6
v1.50.7
v1.50.8
v1.50.9
v1.51.0
v1.51.1
v1.51.10
v1.51.11
v1.51.12
v1.51.13
v1.51.2
v1.51.3
v1.51.4
v1.51.5
v1.51.6
v1.51.7
v1.51.8
v1.51.9
v1.52.0
v1.53.0
v1.53.1
v1.53.10
v1.53.11
v1.53.2
v1.53.3
v1.53.4
v1.53.5
v1.53.6
v1.53.7
v1.53.8
v1.53.9
v1.54.0
v1.54.1
v1.55.0
v1.56.0
v1.56.1
v1.56.2
v1.56.3
v1.56.4
v1.56.5
v1.56.6
v1.57.0
v1.57.1
v1.58.0
v1.58.1
v1.58.2
v1.58.3
v1.58.4
v1.58.5
v1.58.6
v1.59.0
v1.59.1
v1.59.2
v1.60.0
v1.60.1
v1.60.2
v1.61.0
v1.61.1
v1.62.0
v1.62.1
v1.63.0
v1.63.0a
v1.63.2
v1.63.3
v1.63.4
v1.63.5
v1.63.6
v1.64.0
v1.64.1
v1.64.2
v1.65.0
v1.65.1
v1.65.2
v1.65.3
v1.66.0
v1.66.1
v1.66.2
v1.67.0
v1.67.1
v1.67.2
v1.68.0
v1.68.1
v1.68.2
v1.68.3
v1.69.0
v1.69.1
v1.69.2
v1.69.3
v2.*
v2.0.0
v2.0.0-a
v2.0.1
v2.0.2
v2.0.4
v2.1.0
v2.1.1
v2.1.2
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.7.4
v2.8.0
v2.8.1
v2.8.2
v2.9.0
v2.9.1
v2.9.2
v2.9.3
v2.9.4
v2.9.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62382.json"