Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
GraphQL AdminGenerateSessionPayload is leaked to staff with no permissionAnalysed#898528	Valid	No weakness recorded	–	2020-07-16	–	173
Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.comAnalysed#1457471	Valid	Access Control	Medium	2025-03-20	–	181
IDOR on GraphQL queries BillingDocumentDownload and BillDetailsAnalysed#2207248	Valid	Insecure Direct Object Reference	–	2024-02-08	$5,000	187
H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie StuffingAnalysed#422043	Valid	Cross-site Scripting	–	2019-04-17	–	195
Shopify Partners Invitation Process Allows Privilege Escalation Without Email VerificationAnalysed#2885269	Valid	Access Control	Medium	2025-05-15	–	245
Ability to bypass partner email confirmation to take over any store given an employee emailAnalysed#300305	Valid	Race Conditions	–	2018-02-07	$15,250	273
Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email ConfirmationAnalysed#796956	Valid	No weakness recorded	–	2020-04-01	–	310
Shopify admin authentication bypass using partners.shopify.comAnalysed#270981	Valid	Access Control	–	2017-09-28	–	311
Stored XSS in my staff name fired in another your internal panelAnalysed#946053	Valid	Cross-site Scripting	–	2020-07-29	–	326
XSS while logging using GoogleAnalysed#691611	Valid	Cross-site Scripting	–	2019-09-11	$1,750	341
H1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsAnalysed#423467	Valid	Input Validation and Logic	–	2019-11-04	–	372
H1514 Server Side Template Injection in Return Magic email templates?Analysed#423541	Valid	Command and Code Injection	–	2019-04-04	–	409
Shopify Stocky App OAuth MisconfigurationAnalysed#740989	Valid	Access Control	–	2019-12-11	–	527
Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationAnalysed#910300	Valid	Access Control	–	2020-09-15	–	559
H1514 Remote Code Execution on kitcrm using bulk customer update of Priority ProductsAnalysed#422944	Valid	Command and Code Injection	–	2020-02-06	–	830
[Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationAnalysed#796808	Valid	No weakness recorded	–	2020-04-01	–	894
Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOAnalysed#791775	Valid	No weakness recorded	–	2020-04-01	–	1,922
Takeover an account that doesn't have a Shopify ID and moreAnalysed#867513	Valid	No weakness recorded	–	2020-09-02	–	3,006

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.