{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-59805 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-59805 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-59805 is a high-severity missing authorization vulnerability in antiwork gumroad, published on 8 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-59805 and fix it if it is affected.\n\nWhat it is: CVE-2026-59805 is a high-severity missing authorization vulnerability in antiwork gumroad, published on 8 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-59805 in the wild and no public exploit code.\n\nAffected product: antiwork gumroad. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-59805/ (Markdown: https://insights.sbomify.com/CVE-2026-59805/index.md)","id":"CVE-2026-59805","markdown":"https://insights.sbomify.com/CVE-2026-59805/index.md","name":"CVE-2026-59805","record":{"aliases":["GHSA-4w48-6p23-843q"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_modify","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"E-commerce platform","requires_auth":"low_privilege","summary":"Authenticated sellers can revoke or restore buyer access to other sellers' products due to missing ownership validation in the PurchasesController.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"description":"Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase access for other sellers' products by sending PUT requests to the revoke_access and undo_revoke_access actions without seller ownership validation. Attackers can modify the is_access_revoked status on arbitrary purchases to unauthorized revoke or restore buyer access to products they do not own.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Gumroad \u003c 2026.07.06.2 - Insecure Direct Object Reference in PurchasesController","id":"CVE-2026-59805","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"Gradio \u003c 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint","id":"CVE-2026-59806"},"packages":[],"prev":{"headline":"Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket","id":"CVE-2026-59804"},"products":["gumroad"],"published":"2026-07-08","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-08","vendors":["antiwork"]},"summary":"Authenticated sellers can revoke or restore buyer access to other sellers' products due to missing ownership validation in the PurchasesController.","url":"https://insights.sbomify.com/CVE-2026-59805/"}