CVE-2026-62382: fallo de gravedad media en pglombardo PasswordPusher
PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
48Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 6.9epss 1.2%
PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes and the deletable_by_viewer restriction is never enforced. An attacker who knows only the secret URL can permanently delete an anonymous push even when the creator disabled viewer deletion and even without the passphrase. Only deployments that allow anonymous pushes (the default) are affected. The issue is fixed in v2.9.6.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
pglombardo · PasswordPusherPoCs públicas encontradas — 1
cve_referencetpaidakis.com/writeups/passwordpusher-nil-authorization/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — pglombardo PasswordPusher
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-52796MEDIUMPassword Pusher's rate limiter can be bypassed by forging proxy headersEPSS 0.5%CVE-2026-61458HIGHPasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled EndpointEPSS 0.4%CVE-2026-87816HIGHPasswordPusher before 2.11.1 Race Condition View Limit BypassEPSS 0.4%CVE-2024-51989HIGHCross-site Scripting (XSS) Vulnerability in PasswordPusherEPSS 0.4%CVE-2026-41308MEDIUMPassword Pusher: JSON API `/p.json` file upload alias bypasses file-push authenticationEPSS 0.3%CVE-2024-56733MEDIUMPassword Pusher Allows Session Token Interception Leading to Potential HijackingEPSS 0.2%