CVE-2026-62382 Details.
PasswordPusher v1.45.11-v2.9.5 - Unauthenticated Anonymous Push Deletion via Ownership Bypass
Atlas does not check this one. Needs requests that change data.
To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check.
About CVE-2026-62382. What It Means.
PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous pushes due to a nil==nil ownership-check bypass (CWE-863). The deletion guard evaluates (@push.user == current_user) || @push.deletable_by_viewer. For anonymous pushes, @push.user is nil; for unauthenticated requests, current_user is nil. Ruby evaluates nil==nil as true, so the ownership check passes and the deletable_by_viewer=false restriction is completely bypassed. Anyone who knows the se…
Affected Product. What Is Hit.
- Vendor
- pglombardo
- Product
- Pglombardo PasswordPusher
FAQ
Common Questions.
PasswordPusher v1.45.11-v2.9.5 - Unauthenticated Anonymous Push Deletion via Ownership Bypass. PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous pushes due to a nil==nil ownership-check bypass (CWE-863). The deletion guard evaluates (@push.user == current_user) || @push.deletable_by_viewer. For anonymous pushes, @push.user is nil; for unauthenticated requests, current_user is nil. Ruby evaluates nil==nil as true, so the ownership check passes and the deletable_by_viewer=false restriction is completely bypassed. Anyone who knows the se…
No. To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check. The facts about CVE-2026-62382 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-62382 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Pglombardo PasswordPusher to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-62382. Atlas does not run a check for it, so nothing here says whether a particular site is affected.