The vulnerability allows an attacker who knows a secret URL to permanently delete an anonymous push. The push deletion logic compares the push owner against the current user; when both are nil, Ruby treats nil == nil as true, so the deletion restriction is bypassed. Consequently, an attacker can erase data even when the push creator disabled viewer deletion and without the passphrase, causing loss of information.

The affected product is PasswordPusher version 1.45.11 through 2.9.5. Any instance that allows anonymous pushes—which is the default—is vulnerable. The issue is fixed in 2.9.6.

With a CVSS score of 6.9 the vulnerability is of moderate severity. EPSS data is not available and it is not listed in the CISA KEV catalog, but the problem can be exploited remotely by anyone who possesses the secret URL. No authentication is required, making the attack path straightforward and likely to be used if discovered.