CVE-2026-59805 describes a broken access control vulnerability in the PurchasesController of Gumroad before version 2026.07.06.2. Authenticated sellers can exploit this flaw by sending PUT requests to the revoke_access and undo_revoke_access endpoints to modify the is_access_revoked status on purchases belonging to other sellers. The vulnerability arises because the application fails to validate seller ownership before allowing these actions, enabling unauthorized revocation or restoration of buyer access to products.

An attacker with authenticated seller privileges can revoke or restore buyer access to products they do not own. This could disrupt legitimate buyers' access to purchased products or restore access improperly, potentially causing financial and reputational damage to affected sellers. The vulnerability does not require user interaction and has a low attack complexity, making exploitation feasible by authorized sellers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict seller permissions where possible and monitor for suspicious activity related to purchase access modifications. Avoid granting unnecessary privileges to sellers that could allow abuse of these endpoints.