PT-2026-56567 · Antiwork · Gumroad

George Chen · Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-59805

Mitre

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase access for other sellers' products by sending PUT requests to the revoke access and undo revoke access actions without seller ownership validation. Attackers can modify the is access revoked status on arbitrary purchases to unauthorized revoke or restore buyer access to products they do not own.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-59805

Produtos afetados

Gumroad

Referências · 6

• https://github.com/antiwork/gumroad/issues/5725 · Nota
• https://github.com/antiwork/gumroad/commit/e7fd0e610e73135ecf1aa07c197a36fa524832e1 · Correção
• https://github.com/antiwork/gumroad/releases/tag/v2026.07.06.2 · Nota
• https://github.com/antiwork/gumroad/pull/5731 · Nota
• https://vulncheck.com/advisories/gumroad-insecure-direct-object-reference-in-purchasescontroller · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-59805 · Nota de Segurança