Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalation Analysed #910300 Valid Access Control Critical 2020-09-15 – 559 Shopify Stocky App OAuth Misconfiguration Analysed #740989 Valid Access Control Medium 2019-12-11 – 527 Shopify admin authentication bypass using partners.shopify.com Analysed #270981 Valid Access Control Critical 2017-09-28 – 311 Shopify Partners Invitation Process Allows Privilege Escalation Without Email Verification Analysed #2885269 Valid Access Control Medium 2025-05-15 – 245 Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.com Analysed #1457471 Valid Access Control Medium 2025-03-20 – 181 [h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034) Analysed #1086108 Valid Access Control Medium 2021-03-25 $3,100 166 Undocumented `fileCopy` GraphQL API Analysed #981472 Valid Access Control Medium 2020-10-22 $2,000 157 User with removed manage shops permissions is still able to make changes to a shop Analysed #273099 Valid Access Control Medium 2020-06-12 – 145 Create free Shopify application credits. Analysed #1257428 Valid Access Control Medium 2021-09-10 – 134 Disclose Any Store products, Files, Purchase Orders Via Email through Shopify Stocky APP Analysed #763994 Valid Access Control – 2020-02-02 – 116 Access to Employee calendar disclosing internal presentation and meetings Analysed #489284 Valid Access Control Low 2019-03-08 $1,000 111 Admin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.php Analysed #1417288 Valid Access Control Medium 2022-08-11 $2,900 109 Ability to publish a paid theme without purchasing it. Analysed #953083 Valid Access Control Low 2020-08-27 $2,000 90 Add new development stores without permission Analysed #1167453 Valid Access Control Medium 2021-06-04 – 89 A non-privileged user may create an admin account in Stocky Analysed #1245736 Valid Access Control Medium 2021-11-25 – 67 URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript Execution Analysed #1737358 Valid Access Control Low 2025-09-17 – 65 Non-store owners can transfer Shopify-managed domain to another domain provider Analysed #1820953 Valid Access Control Medium 2024-01-17 – 58 staff can able to extend shopify trial period without admin permission Analysed #947728 Valid Access Control Low 2020-09-15 – 56 [h1-2102] [Oberlo] Least privileged user can cancel account owner's subscription via POST on /payments/subscribe Analysed #1084865 Valid Access Control Low 2024-01-17 – 51 Bypass of fix #1370749 Analysed #1489077 Valid Access Control Low 2022-04-22 $900 50 ability to install paid themes for free Analysed #273557 Valid Access Control Medium 2018-05-16 – 50 H1514 Bypass Wholesale account signup restrictions Analysed #423496 Valid Access Control Medium 2019-06-07 – 48 Able to Login deactivated staff account in shopify app mobile Analysed #175490 Valid Access Control – 2016-11-29 – 48 Collaborators and Staff members without all necessary permissions are able to create, edit and install custom apps Analysed #1555502 Valid Access Control Medium 2022-07-11 $1,900 46 Subdomain Takeover - https://competition.shopify.com/ Analysed #365853 Valid Access Control Medium 2018-06-19 – 45 H1514 Removed Staff members who had "Apps" permission can still modify flow app connections Analysed #416983 Valid Access Control Low 2019-06-14 – 44 Removed staff members who had "Manage shops" permission can still create development stores Analysed #254588 Valid Access Control Medium 2019-11-08 – 38 Low Privileged user can add or remove cash to/from sales register Analysed #905543 Valid Access Control Low 2021-06-16 – 37 Unathorised access to admin endpoint on plus-website-staging5.shopifycloud.com Analysed #1394982 Valid Access Control Medium 2021-12-03 – 35 [h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserTfaEnforcement Analysed #1085042 Valid Access Control Medium 2022-07-11 – 34 Add new managed stores without permission Analysed #1167753 Valid Access Control Medium 2021-07-08 – 32 [h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserRole Analysed #1084638 Valid Access Control Medium 2022-04-21 – 31 any staff members have the ability to comment in [discounts] he/she can disable comment section it to other staff even the admin of the store Analysed #629150 Valid Access Control Low 2019-07-15 – 30 Bypass report #416983 - Removed Staff members who had "Apps" permission can still modify flow app connections Analysed #698708 Valid Access Control Medium 2019-10-10 – 28 Staff can create workflows in Shopify Admin without apps permission Analysed #1521336 Valid Access Control Medium 2022-10-13 – 26 Staff can use BULK_OPERATIONS_FINISH webhook topic using Graphql without permissions all Analysed #1350095 Valid Access Control Medium 2021-12-04 – 26 [ux.shopify.com] Subdomain takeover Analysed #221631 Valid Access Control Medium 2018-10-19 – 26 Low Privileged Staff Member Can Export Billing Charges Analysed #1010835 Valid Access Control Medium 2020-11-26 $1,900 24 [h1-2102] [Plus] User with Store Management Permission can Make changeDomainEnforcementState - that should be limited to User Management Only Analysed #1084892 Valid Access Control Medium 2022-04-21 – 23 STAFF member with NO Explicit permissions can view `ActivityFeed` via GraphQL Analysed #528940 Valid Access Control Low 2019-06-18 $500 23 Order Creation Webhooks can be edited/deleted by STAFF with `Settings` only permission Analysed #431633 Valid Access Control Low 2019-05-11 $500 22 staffOrderNotificationSubscriptionDelete Could Be Used By Staff Member With Settings Permission Analysed #1102660 Valid Access Control Low 2022-02-09 – 21 staffOrderNotificationSubscriptionCreate Is Not Blocked Entirely From Staff Member With Settings Permission Analysed #1102652 Valid Access Control Low 2022-02-09 – 21 Ability to publish a paid theme without purchasing it. Analysed #927567 Valid Access Control Low 2020-08-27 $2,000 21 Password reset link not expired at Stocky App Analysed #898841 Valid Access Control – 2020-08-18 – 21 Unpublished Product Images can be disclosed Analysed #534554 Valid Access Control Low 2019-06-12 $500 20 Attacker is able to query Github repositories of arbitrary Shopify Hydrogen Users Analysed #1692788 Valid Access Control Low 2023-03-09 $900 19 Domain Takeover at 3hopify.media Analysed #1344982 Valid Access Control None 2021-10-21 – 19 Staff with no permissions could possibly list and accept billing promotions Analysed #1044869 Valid Access Control Low 2021-04-08 $600 18 Improper access check by Kit leads to controlling attributes of store & getting analytics by deleted Store member via dual messenger A/C Analysed #351519 Valid Access Control Low 2018-06-15 $500 18