unauthorized access to all collections name #93004 Valid Access Control – 2015-10-14 $2,000 2 staff memeber can install apps even if have limitied access #134757 Valid Access Control – 2016-05-04 – 2 Invitation issue #56726 Valid Access Control – 2015-09-16 – 3 Accessing Payments page and adding payment methods with limited access accounts #92481 Valid Access Control – 2015-11-10 $500 3 First & Last Name Disclosure of any Shopify Store Admin #93294 Valid Access Control – 2015-11-09 – 3 A 'Full access' administrator is able to see the shop owners user details #96890 Valid Access Control – 2015-11-10 $500 3 Apps can access 'channels' beta api #98499 Valid Access Control – 2015-11-18 $500 3 Missing authorization check on dashboard overviews #93680 Valid Access Control – 2015-11-10 $500 4 Shop admin can change external login services #56626 Valid Access Control – 2015-10-02 $1,000 5 get users information without full access #93616 Valid Access Control – 2015-11-04 $500 5 Subdomain takeover in help.tictail.com pointing to Zendesk (a Shopify acquisition) #869605 Valid Access Control Medium 2020-08-24 – 5 Staff members with no permission can access to the files, uploaded by the administrator #97452 Valid Access Control – 2016-07-07 $500 7 Staff member can delete Private Apps #155704 Valid Access Control – 2016-08-09 – 7 Deleted Post and Administrative Function Access in eCommerce Forum #167846 Valid Access Control – 2016-10-05 – 7 Privilege Escalation - A `MEMBER` with no ACCESS to `ORDERS` can still access the orders by using `Order Printer APP` #64164 Valid Access Control – 2016-04-20 $1,000 8 H1514 Ability to Edit Packaging Slip Templates and View Product & Shipping Information by a low privileged staff in a Sandbox Store #423198 Valid Access Control Low 2019-04-24 $500 8 The authentication code when activating 2FA can be used again to log in #695041 Valid Access Control Low 2021-02-11 – 8 Partner's non-verified business email change reflected into Shopify Collaborator Request #874574 Valid Access Control – 2020-09-14 – 8 Delete/modify your own comment after limited access(IDOR) #154410 Valid Access Control – 2016-08-09 – 9 API Webhooks Fire And Are Unlisted After Permissions Removed #227230 Valid Access Control Low 2017-06-27 – 9 A staff without export customers permissions can still export customers CSV file #860197 Valid Access Control – 2020-09-15 – 9 H1514 Wholesale customer without checkout permission can complete purchases #423546 Valid Access Control Medium 2019-04-10 – 10 [h1-2102] [Plus] User with Store Management Permission can Make convertUsersFromSaml/convertUsersToSaml - that should be limited to User Management #1084904 Valid Access Control Medium 2022-04-21 – 11 H1514 Lack of access control on edit packing slip template #417839 Valid Access Control Low 2019-04-24 $500 12 Orders full read for a staff with only `Customers` permissions. #1392032 Valid Access Control Low 2022-02-10 $800 12 From full-access account to Account Owner #99863 Valid Access Control – 2018-09-18 $500 13 Add store to new partner account without confirming email address. #633371 Valid Access Control Medium 2020-01-02 – 13 Staff member with no permission can delete POS staff from account settings #860348 Valid Access Control Low 2020-09-14 $500 14 Improper deep link validation #1087744 Valid Access Control Low 2022-07-11 – 14 Subdomain Takeover at course.oberlo.com #1690951 Valid Access Control None 2022-12-01 – 14 [h1-2102] [PLUS] User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only #1084939 Valid Access Control Medium 2022-04-21 – 15 User with no Develop apps permission can Uninstall Custom App Analysed #1466855 Valid Access Control Low 2022-04-21 – 15 Order notifications being sent for a deactivated staff account Analysed #331223 Valid Access Control Low 2018-04-12 $500 16 After changing the storefront password, the preview link is still valid Analysed #1370749 Valid Access Control Low 2022-04-21 – 16 Github base action takeover which is used in `github.com/Shopify/unity-buy-sdk` Analysed #1439355 Valid Access Control Low 2022-07-12 – 16 [h1-2102] Partner's team member with no permission can retrieve services financial data Analysed #1091380 Valid Access Control Medium 2021-04-08 – 17 Theme editor `oseid` parameter is leaked to third-party services through the `Referer` header which leads to somekind of storefront password bypass. Analysed #1262434 Valid Access Control Low 2022-07-11 $500 17 Improper access check by Kit leads to controlling attributes of store & getting analytics by deleted Store member via dual messenger A/C Analysed #351519 Valid Access Control Low 2018-06-15 $500 18 Staff with no permissions could possibly list and accept billing promotions Analysed #1044869 Valid Access Control Low 2021-04-08 $600 18 Domain Takeover at 3hopify.media Analysed #1344982 Valid Access Control None 2021-10-21 – 19 Attacker is able to query Github repositories of arbitrary Shopify Hydrogen Users Analysed #1692788 Valid Access Control Low 2023-03-09 $900 19 Unpublished Product Images can be disclosed Analysed #534554 Valid Access Control Low 2019-06-12 $500 20 Password reset link not expired at Stocky App Analysed #898841 Valid Access Control – 2020-08-18 – 21 Ability to publish a paid theme without purchasing it. Analysed #927567 Valid Access Control Low 2020-08-27 $2,000 21 staffOrderNotificationSubscriptionCreate Is Not Blocked Entirely From Staff Member With Settings Permission Analysed #1102652 Valid Access Control Low 2022-02-09 – 21 staffOrderNotificationSubscriptionDelete Could Be Used By Staff Member With Settings Permission Analysed #1102660 Valid Access Control Low 2022-02-09 – 21 Order Creation Webhooks can be edited/deleted by STAFF with `Settings` only permission Analysed #431633 Valid Access Control Low 2019-05-11 $500 22 STAFF member with NO Explicit permissions can view `ActivityFeed` via GraphQL Analysed #528940 Valid Access Control Low 2019-06-18 $500 23 [h1-2102] [Plus] User with Store Management Permission can Make changeDomainEnforcementState - that should be limited to User Management Only Analysed #1084892 Valid Access Control Medium 2022-04-21 – 23 Low Privileged Staff Member Can Export Billing Charges Analysed #1010835 Valid Access Control Medium 2020-11-26 $1,900 24