This CVE exposes a fundamental authorization collapse in how anonymous pushes are handled. The vulnerability lives in a single ownership check: @push.user == current_user. When both values are nil—which is the default state for anonymous pushes—Ruby evaluates nil == nil as true. This makes the push appear self-owned, bypassing viewer deletion settings that would otherwise require explicit consent. The deletable_by_viewer guard never executes because the code thinks the requester already owns the push.
The deeper architectural flaw is that URL knowledge has become a de facto identity token. The secret URL, designed as a sharing credential, now functions as proof of ownership for deletion purposes. Anyone with the URL can delete an anonymous push regardless of viewer settings or passphrase requirements. This collapses two distinct security boundaries: accessing a URL and being authorized to modify its content.
The fix in v2.9.6 reportedly adds nil guards, but you should verify it explicitly handles the nil case rather than relying on implicit behavior. More importantly, audit your codebase for other authorization paths where nil comparisons could produce similar bypasses—this is a recurring vulnerability genotype across languages and frameworks. The pattern isn't 'forgot to check nil'; it's 'authorization logic written for one threat model now operating against a different one.' When anonymous or unauthenticated users become a supported feature, existing authorization checks may implicitly accept inputs they were never designed to handle.
Check whether any other deletion, modification, or access-control paths conflate URL knowledge with identity. That's the systemic exposure this CVE reveals.