Which versions of Gumroad are affected by EUVD-2026-42374?

Gumroad's PurchasesController in versions before 2026.07.06.2 contains a broken access control vulnerability enabling authenticated sellers to revoke or restore customer access to other sellers'…. A patch is available.

How to fix or mitigate EUVD-2026-42374?

Within 24 hours: Identify all Gumroad instances running versions prior to 2026.07.06.2. Within 7 days: Deploy vendor patch by upgrading all affected instances to Gumroad v2026.07.06.2 or later. Within 30 days: Verify patch deployment across the entire infrastructure, audit access control change logs for evidence of unauthorized modifications, and validate restoration of proper access controls.

Gumroad EUVD-2026-42374

Q: What is the CVSS score of EUVD-2026-42374?

EUVD-2026-42374 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-59805 HIGH

Missing Authorization (CWE-862)

2026-07-08 disclosure@vulncheck.com

GHSA-4w48-6p23-843q

Authentication Bypass

7.1

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable action needing only a low-privilege seller account (PR:L, AC:L, UI:N); impact is tampering with other sellers' purchase-access state, so I:H with C:N and A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 21:04 EUVD

Analysis Generated

Jul 08, 2026 - 20:42 vuln.today

DescriptionCVE.org

Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase access for other sellers' products by sending PUT requests to the revoke_access and undo_revoke_access actions without seller ownership validation. Attackers can modify the is_access_revoked status on arbitrary purchases to unauthorized revoke or restore buyer access to products they do not own.

AnalysisAI

Broken access control in Gumroad's PurchasesController (versions before 2026.07.06.2) lets any authenticated seller revoke or restore buyer access to products they do not own by sending PUT requests to the revoke_access and undo_revoke_access actions, which fail to validate seller ownership. Because the actions operate on arbitrary purchase records via direct object reference, a low-privileged seller can tamper with the is_access_revoked flag on other sellers' sales. No public exploit was identified at time of analysis and the flaw is not listed in CISA KEV, but the fix is confirmed in release v2026.07.06.2.

Technical ContextAI

Gumroad is a Rails-based creator-commerce platform (open-sourced by antiwork) where sellers manage sales through server-side controllers. The vulnerability lives in PurchasesController's revoke_access and undo_revoke_access actions, which mutate the is_access_revoked boolean on a Purchase record. The root cause is CWE-862 (Missing Authorization): the actions accept a purchase identifier and act on it without verifying that the referenced purchase belongs to a product owned by the requesting seller - a classic Insecure Direct Object Reference (IDOR) as VulnCheck classifies it. Although tagged 'Authentication Bypass,' the flaw is more precisely a horizontal authorization failure: authentication succeeds normally, but object-level access control is absent, so identity is checked while ownership of the target object is not.

RemediationAI

Vendor-released patch: 2026.07.06.2 - upgrade to Gumroad release v2026.07.06.2 (https://github.com/antiwork/gumroad/releases/tag/v2026.07.06.2), which adds the missing seller-ownership validation via PR #5731 and commit e7fd0e6. Operators of self-hosted instances who cannot immediately upgrade should add an authorization check enforcing that the purchase referenced by revoke_access and undo_revoke_access belongs to a product owned by the current seller, or temporarily restrict/gate those two PurchasesController routes at the reverse proxy or application layer (side effect: legitimate sellers lose the ability to revoke or restore buyer access until the check is in place). Monitoring PUT requests to these actions and alerting on cross-seller purchase IDs is a low-cost compensating detection control while the patch is rolled out.