Approved changes feed: RSS · Atom
cpe:2.3:a:antiwork:gumroad:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Antiwork (e2498b71-01a8-5b38-9d56-ef935b62cbf5) |
|---|---|
| Product | Gumroad (dca8cd95-f10c-54ba-be88-d336a9fcbdc4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-59805 |
vulnerable | 2026-07-29 01:03:17.608740 |
Gumroad < 2026.07.06.2 - Insecure Direct Object Reference in PurchasesController
MEDIUM (6.5)
Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase access for other sellers' products by sending PUT requests to the revoke_access and undo_revoke_access actions without seller ownership validation. Attackers can modify the is_access_revoked status on arbitrary purchases to unauthorized revoke or restore buyer access to products they do not own.
Published: 2026-07-08T19:43:10.711Z
Updated: 2026-10-08T15:51:33.377Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.