Description
Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase access for other sellers' products by sending PUT requests to the revoke_access and undo_revoke_access actions without seller ownership validation. Attackers can modify the is_access_revoked status on arbitrary purchases to unauthorized revoke or restore buyer access to products they do not own.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
antiwork gumroad
Default version status: unaffected
0 to < 2026.07.06.2affected
pkg:github/antiwork/gumroadReferences
- https://github.com/antiwork/gumroad/issues/5725 ↗
- https://github.com/antiwork/gumroad/releases/tag/v2026.07.06.2 ↗
- https://github.com/antiwork/gumroad/pull/5731 ↗
- https://github.com/antiwork/gumroad/commit/e7fd0e610e73135ecf1aa07c197a36fa524832e1 ↗
- https://www.vulncheck.com/advisories/gumroad-insecure-direct-object-reference-in-purchasescontroller ↗