PasswordPusher CVE-2026-62382

Exploitation requires two conditions: the PasswordPusher instance must have anonymous push creation enabled (this is the default configuration), and the attacker must possess the secret URL of an anonymously created push. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication or user interaction is required. The deletable_by_viewer setting, even when explicitly set to false by the push creator, is bypassed entirely. Any configured passphrase does not protect against deletion. The attack is limited strictly to anonymous pushes - pushes created by authenticated users are not affected because @push.user is non-nil in those cases, causing the ownership check to fail as intended. Knowing or obtaining the secret URL is the sole prerequisite for exploitation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects minimal exploitation friction - no authentication, no special privileges, and no user interaction are required, making the attack automatable against any instance with anonymous pushes enabled. Impact is bounded: VI:L and VA:L indicate that only individual push resources are affected, with no confidentiality exposure (VC:N) and no subsequent-system impact. There is no CISA KEV listing and no reported EPSS figure in the provided data, so exploitation volume in the wild is unconfirmed. The practical risk is a denial-of-secret-delivery attack: an adversary who intercepts or is forwarded a secret URL can silently destroy a credential push before the intended recipient retrieves it, subverting the explicit anti-deletion control the creator configured. This is most dangerous in operational workflows that treat PasswordPusher as a trusted one-time-delivery channel for onboarding credentials or incident-response secrets. The impact is not system compromise but workflow integrity failure - the severity is moderate, but the fix is trivial and the default configuration is vulnerable.

An attacker who receives, intercepts, or guesses a PasswordPusher secret URL sends an unauthenticated HTTP DELETE request to the push deletion endpoint. The server's ownership check compares two nil values, evaluates them as equal, and proceeds to delete the push - ignoring both the deletable_by_viewer flag and any passphrase requirement. The credential push is permanently destroyed before the intended recipient retrieves it, with no indication to the creator that deletion occurred outside their control.