OrderListInitial leaks order details #882412 Valid Information Disclosure Medium 2020-08-18 $1,500 2 List of devices is accessible regardless of the account limitations #97535 Valid Information Disclosure – 2015-11-10 $500 3 CSRF on https://shopify.com/plus #114430 Valid Information Disclosure – 2016-02-17 $500 3 Get analytics token using only apps permission #901775 Valid Information Disclosure Medium 2020-08-18 – 3 Some store settings/data are accessible to "No Access" permission users on GraphQL LiveView operation #409973 Valid Information Disclosure – 2020-08-18 – 4 comment out causes information disclosure #57125 Valid Information Disclosure – 2015-04-19 – 5 Full access to Amazon S3 bucket containing AWS CloudTrail logs #111643 Valid Information Disclosure – 2016-02-01 – 5 Full access at an internal service of Shopify #216389 Valid Information Disclosure – 2017-03-28 – 5 File name and folder enumeration. #118688 Valid Information Disclosure – 2016-03-01 $500 6 STAFF "No-Permissions" on the Store can retrieve the details Order via exchangeReceiptSend #917875 Valid Information Disclosure Medium 2020-08-24 $1,000 6 View all deleted comments and rating of any app . #135756 Valid Information Disclosure – 2016-09-01 – 7 Customer's full name disclosure via Shopify Chat (by email lookup) #1018336 Valid Information Disclosure – 2020-11-19 – 8 store internal email disclosed through shopify-data-exporter #1605962 Valid Information Disclosure Medium 2022-09-15 – 8 Shopify's SF and LA offices Dashboard Information disclosed via Public Gist #729040 Valid Information Disclosure – 2019-11-06 $500 12 SQL Exception thrown during product import #237597 Valid Information Disclosure Medium 2017-07-12 – 14 H1514 Get access to non public information by pivoting with graphql queries #423388 Valid Information Disclosure Low 2019-11-03 $1,500 14 Disclose STUFF member name and make actions. #968174 Valid Information Disclosure None 2022-05-14 $500 15 Publicly Accessible Datadog link #345152 Valid Information Disclosure None 2018-06-15 – 18 PII disclosure -- Past team members & their email ID(personal email) can be viewed by Staff member with no permissions on Partner Dashboard #415622 Valid Information Disclosure Low 2018-11-08 $500 18 [h1-2102] Information disclosure - ShopifyPlus add user displays existing Shopify ID fullname #1083922 Valid Information Disclosure Medium 2022-02-10 – 18 Apache Flink Dashboard exposure at https://streaming-sales-model-production.flink.shopifykloud.com Analysed #1262907 Valid Information Disclosure None 2021-11-18 – 23 H1514 Extract information about other sites (new sites) through Affiliate/Referral pages Analysed #423506 Valid Information Disclosure Medium 2019-11-04 – 24 Staff with no permissions can listen to Shopify Ping conversations by registering to its different WebSocket Events Analysed #1023669 Valid Information Disclosure – 2020-11-19 – 25 Stealing users' facebook access tokens - kitcrm.com Analysed #211477 Valid Information Disclosure – 2017-03-15 – 26 None permission staff member can identify installed application and products attached to it Analysed #848625 Valid Information Disclosure Low 2020-04-21 $500 26 Sidekiq dashboard exposed at notary.shopifycloud.com Analysed #1405673 Valid Information Disclosure Medium 2021-11-25 – 26 GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior) #2886723 Informative Information Disclosure None 2025-09-17 – 28 Potentially Sensitive Information on GitHub Analysed #143438 Valid Information Disclosure – 2016-07-17 – 29 H1514 Deanonymizing Exchange Marketplace private listings Analysed #421009 Valid Information Disclosure Medium 2020-03-10 $1,000 30 Fetching external resources through svg images Analysed #142709 Valid Information Disclosure – 2016-06-21 – 31 Ability to see password protected content by bypassing the password page of shopify preview URL for new development stores (as of August 17, 2020) Analysed #961929 Valid Information Disclosure Medium 2020-08-25 $1,500 32 Production Key and Data Found on Subdomain No Longer Operated by Shopify / Dangling DNS Analysed #1590115 Valid Information Disclosure None 2024-05-01 – 34 [h1-2102] shopApps query from the graphql at /users/api returns all existing created apps, including private ones Analysed #1085332 Valid Information Disclosure Medium 2022-07-15 $1,900 35 User sensitive information disclosure Analysed #975047 Valid Information Disclosure Medium 2020-10-22 $1,000 40 Disclosure of Github Issues Analysed #425719 Valid Information Disclosure Medium 2018-11-08 – 41 [h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilege Analysed #1091303 Valid Information Disclosure Medium 2021-04-08 – 46 H1514 [beerify.shopifycloud.com] GraphQL discloses internal beer consumption Analysed #419883 Valid Information Disclosure None 2019-05-08 $802 57 Using GraphQL, STAFF with NO explicit permissions on Store can retrieve Shopify Payments Balance. Analysed #417170 Valid Information Disclosure Low 2019-04-04 $500 62 Disclose customer orders details by shopify chat application. Analysed #968165 Valid Information Disclosure Medium 2022-05-14 $2,500 65 Shopify GitHub Login and Password exposed all private source code might be available. Analysed #124100 Valid Information Disclosure – 2017-06-08 $1,500 66 CircleCI token in github repo allows for access to sensitive build information Analysed #858915 Valid Information Disclosure – 2020-09-15 – 74 Blog posts atom feed of a store with password protection can be accessed by anyone Analysed #1256375 Valid Information Disclosure Medium 2021-11-08 – 76 [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image Analysed #1021906 Valid Information Disclosure Medium 2020-11-21 $2,900 135