v2.9.6: Security Fix: Prevent unauthorized deletion of anonymous pushes

This release fixes an authorization bug where anyone with a secret URL could permanently delete an anonymous push, even when the creator disabled “deletable by viewer.”

Reported by @theopaid. A CVE and GitHub Security Advisory will be published soon.

📝 What’s Changed

• Fix: Prevent unauthorized deletion of anonymous pushes (#4703) @pglombardo, Peter Giacomo Lombardo

👥 List of contributors

@pglombardo and Peter Giacomo Lombardo

🛥️ Docker Images

Available on Docker Hub:
https://hub.docker.com/r/pglombardo/pwpush

🏃‍♂️ Run This Version

1. Point DNS to your server (e.g. pwpush.example.com).
2. Download docker-compose.yml or clone the repo.
3. In docker-compose.yml, uncomment and set:
   • TLS_DOMAIN: 'pwpush.example.com' for automatic Let’s Encrypt TLS.
4. Run:

docker compose up -d

Open https://pwpush.example.com or alternatively http://your-ip:5100.

🔗 Useful Links

• Documentation
• Docker Hub
• GitHub
• pwpush.com
• X
• Facebook
• Reddit
• Newsletter
• Apnotic