Shopify · disclosed reports
Access Control
87 disclosed reports · $32,000 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Shopify on HackerOne- reports
- 87
- paid a bounty
- 31
Every one of the 87 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalation
- Shopify Stocky App OAuth Misconfiguration
- Shopify admin authentication bypass using partners.shopify.com
- Shopify Partners Invitation Process Allows Privilege Escalation Without Email Verification
- Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.com
- [h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034)
- Undocumented `fileCopy` GraphQL API
- User with removed manage shops permissions is still able to make changes to a shop
- Create free Shopify application credits.
- Disclose Any Store products, Files, Purchase Orders Via Email through Shopify Stocky APP
- Access to Employee calendar disclosing internal presentation and meetings
- Admin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.php
- Ability to publish a paid theme without purchasing it.
- Add new development stores without permission
- A non-privileged user may create an admin account in Stocky
- URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript Execution
- Non-store owners can transfer Shopify-managed domain to another domain provider
- staff can able to extend shopify trial period without admin permission
- [h1-2102] [Oberlo] Least privileged user can cancel account owner's subscription via POST on /payments/subscribe
- Bypass of fix #1370749
- ability to install paid themes for free
- H1514 Bypass Wholesale account signup restrictions
- Able to Login deactivated staff account in shopify app mobile
- Collaborators and Staff members without all necessary permissions are able to create, edit and install custom apps
- Subdomain Takeover - https://competition.shopify.com/
- H1514 Removed Staff members who had "Apps" permission can still modify flow app connections
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.