Is CVE-2026-62382 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62382 being exploited in the wild.

How severe is CVE-2026-62382?

Informational severity, with a CVSS score of 6.9, published 22 August 2026.

Which products and versions are affected?

PasswordPusher PasswordPusher v1.45.11 through v2.9.5.

Is there a fix for CVE-2026-62382?

A patch was published on 2026-08-22: v2.9.6 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62382 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-62382?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62382: PasswordPusher improper authorization in push deletion

CVE-2026-62382 · Severity: info · CVSS 6.9 · Published 2026-08-22

PasswordPusher is a web application that securely shares sensitive information via temporary links with optional passphrases and expiration controls. A flaw in the ownership check for deleting anonymous pushes allows any unauthenticated user with the secret URL to permanently destroy the shared secret—even if the creator explicitly disabled viewer deletion and protected it with a passphrase. This bypasses a core availability guarantee of the service.

Quick answers

Is CVE-2026-62382 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62382 being exploited in the wild.
How severe is CVE-2026-62382?: Informational severity, with a CVSS score of 6.9, published 22 August 2026.
Which products and versions are affected?: PasswordPusher PasswordPusher v1.45.11 through v2.9.5.
Is there a fix for CVE-2026-62382?: A patch was published on 2026-08-22: v2.9.6 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62382 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-62382?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an improper authorization vulnerability (CWE-863) in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values evaluate to nil, and Ruby evaluates nil == nil as true, causing the check to pass and the deletable_by_viewer restriction to be bypassed. The vulnerability exists in both the REST API and web controller destroy/expire actions. An unauthenticated attacker who knows only the secret URL can trigger the expire! method, which irreversibly clears the payload, passphrase, and attachments. No authentication, credentials, or passphrase knowledge is required. The issue was introduced in v1.45.11 by a commit that replaced explicit user_signed_in? branching with a nil comparison. The fix is available in v2.9.6, which re-adds proper guards for the anonymous case.

Affected products

PasswordPusher PasswordPusher v1.45.11 through v2.9.5

Timeline

2026-08-07: disclosed: GitHub Security Advisory GHSA-jf2m-hpj9-4qx2 published
2026-08-22: patched: v2.9.6 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.