Shopify · disclosed reports
No weakness filed
47 disclosed reports · $60,300 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Shopify on HackerOne- reports
- 47
- paid a bounty
- 12
Every one of the 47 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Takeover an account that doesn't have a Shopify ID and more
- Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSO
- Github access token exposure
- [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation
- Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation
- GraphQL AdminGenerateSessionPayload is leaked to staff with no permission
- Session works after logout from Shopify account and password of online store is displayed
- Informations disclosure - Access to some checkout informations
- Account Takeover Vulnerability in Shopify Collabs Platform Due to Missing Email Verification
- Ability to link a Google account to another staff account/store owner that isn't linked yet
- admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed
- Staff without Manage Themes permissions can update themes
- Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store!
- Staff who only have apps and channels permission can do a takeover account at the wholesale store (Bypass get invitation link)
- Misconfiguration in Two Factor Authorisation
- mruby-engine: UAF in MRubyEngine#initialize enables local RCE
- Script Editor preview token still working with uninstalled application, even for unpublished script
- [Privilege Escalation] Shopify Admin -- Permission from Settings to Customer
- subdomain Takeover at blog.exchangemarketplace.com
- Is the Google Bucket Meant To Be Publicly Listable? https://cdn.shopify.com/shop-assets/
- xss triggered in "myshopify.com/admin/product"
- Subdomain Takeover in http://genghis-cdn.shopify.io/ pointing to Fastly
- Ability to potentially hit internal NGINX locations on *.myshopify.com by making use of the `X-Accel-Redirect` header via a configured App Proxy
- Information disclosure ( Google Sales Channel )
- HTTP-Response-Splitting on v.shopify.com
- Staff Member can Get POS Access Without User Interaction
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.