Broken Access Control in Gumroad PurchasesController

Impact Analysis

This vulnerability can impact you by allowing unauthorized sellers to revoke or restore buyer access to products they do not own. This means that a malicious seller could prevent legitimate buyers from accessing their purchased products or restore access improperly, potentially causing loss of revenue, customer trust, and disruption of service.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-59805 is an Insecure Direct Object Reference (IDOR) vulnerability in Gumroad's PurchasesController. It allows any authenticated seller to manipulate purchase access for products they do not own by sending crafted PUT requests to the revoke_access and undo_revoke_access actions. These actions lacked proper seller ownership verification, enabling attackers to revoke or restore buyer access to purchases belonging to other sellers without authorization.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized PUT requests to the revoke_access and undo_revoke_access actions in Gumroad's PurchasesController. Detection can focus on monitoring for unusual or unauthorized PUT requests targeting endpoints like /purchases/:external_id/revoke_access or /purchases/:external_id/undo_revoke_access.

Commands to detect such activity could include network traffic inspection or web server log analysis to identify PUT requests to these specific endpoints from authenticated sellers who do not own the referenced purchase.

• Use tools like tcpdump or Wireshark to capture HTTP traffic and filter for PUT requests to /purchases/*/revoke_access or /undo_revoke_access.
• Analyze web server logs (e.g., using grep) for PUT requests to these endpoints, for example: grep 'PUT /purchases/' /var/log/nginx/access.log | grep 'revoke_access'
• Implement application-level logging to record seller IDs and external purchase IDs for revoke_access and undo_revoke_access actions to detect suspicious cross-seller access attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to update Gumroad to version 2026.07.06.2 or later, where the vulnerability has been fixed by adding proper seller ownership verification to the revoke_access and undo_revoke_access actions.

If immediate update is not possible, restrict access to the affected endpoints by implementing additional access controls or monitoring to detect and block unauthorized PUT requests.

• Apply the patch that adds the verify_current_seller_is_seller_for_purchase before-action filter to the revoke_access and undo_revoke_access actions.
• Review and audit seller permissions to ensure no unauthorized sellers can perform cross-seller access revocation.
• Monitor logs for suspicious activity related to these endpoints and respond promptly to any detected abuse.

Useful 0 Not Useful 0