The vulnerability is a broken access control flaw in Gumroad’s PurchasesController. Authenticated sellers can alter the is_access_revoked flag on purchases belonging to other sellers by sending PUT requests to the revoke_access and undo_revoke_access actions. This allows a seller to revoke or restore buyer access to products they do not own, compromising the integrity of the platform’s purchase access data. The weakness is categorized as an authorization failure (CWE‑862).

The problem affects the Gumroad platform published by antiwork and applies to all releases earlier than 2026.07.06.2. Users running any of those older versions are susceptible to this access control bypass.

The CVSS score of 7.1 indicates a medium‑to‑high severity risk. Attackers need only have a legitimate seller account and the ability to craft PUT requests to the revoke_access and undo_revoke_access endpoints. The EPSS score is less than 1%, implying a low probability of public exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the lack of ownership validation creates a significant internal misuse vector that can lead to unauthorized control over buyer access.