Executive brief
Gumroad is an e-commerce platform that allows creators to sell digital products directly to consumers. A security flaw in the platform's purchase management system allowed any registered seller to revoke or restore customer access to products belonging to other sellers. This could lead to significant business disruption, customer dissatisfaction, and unauthorized access to digital goods.
Technical details
A broken access control vulnerability (Insecure Direct Object Reference) exists in the `PurchasesController` of Gumroad. The `revoke_access` and `undo_revoke_access` actions failed to implement the `verify_current_seller_is_seller_for_purchase` ownership validation guard. An authenticated attacker with a seller account can send unauthorized PUT requests to these endpoints using a known purchase external ID. This allows the attacker to modify the `is_access_revoked` status of purchases belonging to other sellers, effectively revoking or restoring buyer access to products the attacker does not own. The issue was addressed in version 2026.07.06.2 by adding the missing actions to the authorization filter.
Affected products
- antiwork Gumroad before 2026.07.06.2
Timeline
- 2026-06-04: disclosed: Vulnerability reported to vendor via email
- 2026-07-06: patched: Fix merged and version 2026.07.06.2 released
- 2026-07-08: advisory: CVE published and NVD record created
References
- https://github.com/antiwork/gumroad/commit/e7fd0e610e73135ecf1aa07c197a36fa524832e1
- https://github.com/antiwork/gumroad/issues/5725
- https://github.com/antiwork/gumroad/pull/5731
- https://github.com/antiwork/gumroad/releases/tag/v2026.07.06.2
- https://www.vulncheck.com/advisories/gumroad-insecure-direct-object-reference-in-purchasescontroller