CVE-2026-59805: Gumroad Broken Access Control Vulnerability – Seller Sabotage Risk

Technical summary

CVE-2026-59805 is a broken access control vulnerability (CWE-862) in Gumroad's PurchasesController. The revoke_access and undo_revoke_access endpoints accept PUT requests from authenticated sellers without validating seller ownership of the target product. An attacker can directly manipulate the is_access_revoked flag on purchases they do not own, bypassing authorization checks. The vulnerability requires valid seller authentication but no additional elevation, and impacts the integrity of purchase access controls across the platform.

Business impact

This vulnerability enables seller-to-seller sabotage on the Gumroad marketplace. A malicious seller could revoke legitimate buyers' access to competitors' products, disrupting sales and customer trust. Alternatively, they could restore access to revoked purchases inappropriately. The damage is primarily reputational and operational for affected sellers, and erodes buyer confidence in purchase integrity. Gumroad's marketplace viability depends on trust in access control—unauthorized manipulation directly undermines that model.

Affected systems

Gumroad versions before 2026.07.06.2 are affected. Any organization or individual using Gumroad as a seller is at risk of having their product access controls manipulated by other authenticated sellers on the platform. Buyers are indirectly affected through potential access disruptions.

Exploitability

Exploitation is straightforward for any authenticated Gumroad seller. No additional privilege escalation, social engineering, or user interaction is required—only a valid seller account and knowledge of a target product's purchase identifiers. The attack is network-accessible and leaves audit trails in access logs, but the low barrier to entry makes this a practical risk.

Remediation

Upgrade Gumroad to version 2026.07.06.2 or later. This patch adds seller ownership validation to the revoke_access and undo_revoke_access endpoints, ensuring a seller can only modify access for their own products. Review access control logs for unauthorized modifications prior to patching, particularly any revoke/restore actions from unexpected sellers.

Patch guidance

Apply the 2026.07.06.2 update immediately via your Gumroad account management dashboard. Verify the patch is live by checking your version number in account settings. No configuration changes are required post-patch. If you host a custom Gumroad integration, confirm your integration layer does not bypass these checks.

Detection guidance

Monitor Gumroad audit logs for revoke_access or undo_revoke_access API calls from sellers who do not own the targeted products. Correlate seller identity with product ownership. Flag unexpected access restoration events, especially if products were legitimately revoked. Alert on rapid sequences of access changes from a single seller account targeting multiple products they do not own. Check for any buyer complaints about unexpected access changes or suspensions.

Why prioritize this

Although the CVSS score is 6.5 (Medium), the real-world impact on marketplace integrity and seller trust is significant. The low exploit complexity and ease of abuse by any seller make this practically important despite the authentication requirement. Organizations should prioritize patching within their normal maintenance window, not delay it. For high-volume sellers, this is a near-term fix.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects the fact that the attack requires prior authentication and affects only integrity (not confidentiality or availability). The attack vector is network-based and requires no user interaction, keeping the score in the Medium range. However, the business logic context—deliberate sabotage by a peer actor—may warrant treating it as higher priority than the base score suggests.

Frequently asked questions