PT-2026-56567 · Antiwork · Gumroad

George Chen · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-59805

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase access for other sellers' products by sending PUT requests to the revoke access and undo revoke access actions without seller ownership validation. Attackers can modify the is access revoked status on arbitrary purchases to unauthorized revoke or restore buyer access to products they do not own.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-59805

Affected Products

Gumroad

References · 6

• https://github.com/antiwork/gumroad/commit/e7fd0e610e73135ecf1aa07c197a36fa524832e1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-59805 · Security Note
• https://github.com/antiwork/gumroad/issues/5725 · Note
• https://github.com/antiwork/gumroad/releases/tag/v2026.07.06.2 · Note
• https://github.com/antiwork/gumroad/pull/5731 · Note
• https://vulncheck.com/advisories/gumroad-insecure-direct-object-reference-in-purchasescontroller · Note