EUVD-2026-64274
GHSA-h7j9-p76m-fhvx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication required (PR:N); only the individual push resource is affected with low integrity and availability impact, no confidentiality loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes and the deletable_by_viewer restriction is never enforced. An attacker who knows only the secret URL can permanently delete an anonymous push even when the creator disabled viewer deletion and even without the passphrase. Only deployments that allow anonymous pushes (the default) are affected. The issue is fixed in v2.9.6.
AnalysisAI
PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous password pushes by exploiting a nil-equality logic flaw in the ownership authorization check. Any party who possesses a push's secret URL can permanently destroy that push - bypassing the creator's explicit deletable_by_viewer=false setting and any passphrase protection - because Ruby evaluates nil == nil as true, causing the ownership gate to pass spuriously for anonymously created pushes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions: the PasswordPusher instance must have anonymous push creation enabled (this is the default configuration), and the attacker must possess the secret URL of an anonymously created push. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects minimal exploitation friction - no authentication, no special privileges, and no user interaction are required, making the attack automatable against any instance with anonymous pushes enabled. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to PasswordPusher v2.9.6, which is the vendor-confirmed fix per the security advisory at https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-jf2m-hpj9-4qx2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Passwordpusher
View allPassphrase brute-force in PasswordPusher before 2.9.2 lets remote attackers who possess a push token recover the passphr
Unauthenticated attackers can create file-type pushes through Password Pusher's JSON API endpoints when the application
Cross-site scripting via data URI injection in PasswordPusher before 2.8.1 allows unauthenticated attackers to create UR
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today