TI-2026-42626 CVE-2026-59805 · GHSA-4w48-6p23-843q
Gumroad < 2026.07.06.2 - Insecure Direct Object Reference in PurchasesController
Priority LOW 31
Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase access for other sellers' products by sending PUT requests to…