CyberRota Analysis
AI-GeneratedGumroad versions prior to 2026.07.06.2 are vulnerable due to a broken access control flaw in the PurchasesController, enabling authenticated sellers to alter purchase access for other sellers' products without proper ownership validation. This vulnerability allows attackers to illegitimately revoke or restore buyer access to products they do not own, potentially leading to unauthorized access and financial loss. Sellers using Gumroad should prioritize this issue to protect their product access integrity and prevent exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase access for other sellers' products by sending PUT requests to the revoke_access and undo_revoke_access actions without seller ownership validation. Attackers can modify the is_access_revoked status on arbitrary purchases to unauthorized revoke or restore buyer access to products they do not own.