Force 500 Internal Server Error on any shop (for one user) #55716 Valid Denial of Service – 2015-06-09 – 7 Payment gateway status transferred to Shopify without authentication #56628 Valid Cross-Site Request Forgery – 2016-09-27 – 7 XSS in experts.shopify.com #57459 Valid Cross-site Scripting – 2015-05-19 – 7 Staff members with no permission can access to the files, uploaded by the administrator #97452 Valid Access Control – 2016-07-07 $500 7 XSS in Draft Orders in Timeline i SHOPIFY Admin Site! #117449 Valid Cross-site Scripting – 2016-07-28 – 7 View all deleted comments and rating of any app . #135756 Valid Information Disclosure – 2016-09-01 – 7 Staff member can delete Private Apps #155704 Valid Access Control – 2016-08-09 – 7 Deleted Post and Administrative Function Access in eCommerce Forum #167846 Valid Access Control – 2016-10-05 – 7 Redirect in adding advance cash on delivery app #188266 Valid Open Redirect Low 2017-06-27 – 7 Stored passive XSS at scheduled posts (kitcrm.com) #214581 Valid Cross-site Scripting Medium 2017-03-28 – 7 access permission is not revoked even if the email has been deleted or changed on the partner account -partners.shopify- #870001 Valid No weakness recorded Medium 2020-08-18 – 7 Admin web sessions remain active after logout of Shopify ID #952035 Valid Authentication – 2020-09-14 – 7 Bypass For #997350 your-store.myshopify.com preview link is leak on third party website Via Online Store #1015283 Valid Authentication Low 2022-02-10 $500 7 Missing spf flags for myshopify.com #54779 Valid No weakness recorded – 2015-04-16 – 8 Shopify android client all API request's response leakage, including access_token, cookie, response header, response body content #56002 Valid Authentication – 2015-07-04 – 8 Privilege Escalation - A `MEMBER` with no ACCESS to `ORDERS` can still access the orders by using `Order Printer APP` #64164 Valid Access Control – 2016-04-20 $1,000 8 (FULL PATH DISCLOSURE) Unknown MySQL server host 'shardm-reader.chi2.shopify.io' #157876 Valid Authentication – 2016-09-01 – 8 Open Redirect in shopify app URL #226408 Valid Open Redirect Low 2017-07-21 – 8 [out-of-scope] toxiproxy: Lack of CSRF protection allows an attacker to gain access to internal Shopify network #236349 Valid Server-Side Request Forgery Medium 2018-07-11 – 8 H1514 Ability to Edit Packaging Slip Templates and View Product & Shipping Information by a low privileged staff in a Sandbox Store #423198 Valid Access Control Low 2019-04-24 $500 8 The authentication code when activating 2FA can be used again to log in #695041 Valid Access Control Low 2021-02-11 – 8 Partner's non-verified business email change reflected into Shopify Collaborator Request #874574 Valid Access Control – 2020-09-14 – 8 Stocky App Administrator can create a backdoor admin account by using an existing POS User #962895 Valid No weakness recorded – 2020-08-24 – 8 damage to the timeline so that comment fields cannot be displayed or not available to all members in the store #971599 Valid No weakness recorded – 2020-09-09 – 8 Order lookup features of Shopify Chat Application leads to customer orders enumeration due to lack of user input validation #1017576 Valid No weakness recorded – 2020-11-19 – 8 Customer's full name disclosure via Shopify Chat (by email lookup) #1018336 Valid Information Disclosure – 2020-11-19 – 8 [h1-2102] Break permissions waterfall #1088159 Valid No weakness recorded Low 2022-02-12 $500 8 Same the Url #1459338 Valid No weakness recorded None 2022-04-21 $500 8 store internal email disclosed through shopify-data-exporter #1605962 Valid Information Disclosure Medium 2022-09-15 – 8 Authentication Failed Mobile version #55530 Valid Authentication – 2015-06-02 $500 9 Content Spoofing #58630 Valid Misconfiguration and Insecure Design – 2015-05-05 – 9 SSL cookie without secure flag set #58679 Valid Misconfiguration and Insecure Design – 2015-07-13 – 9 Missing of csrf protection #96470 Valid Cross-Site Request Forgery – 2015-12-07 $500 9 Delete/modify your own comment after limited access(IDOR) #154410 Valid Access Control – 2016-08-09 – 9 [ecommerce.shopify.com] Invalidated redirection #175168 Valid Open Redirect Low 2016-12-04 – 9 ShopifyAPI is vulnerable to timing attacks. #224096 Valid Cryptography Low 2017-06-23 – 9 API Webhooks Fire And Are Unlisted After Permissions Removed #227230 Valid Access Control Low 2017-06-27 – 9 Potential SSRF and disclosure of sensitive site on *shopifycloud.com #382612 Valid Server-Side Request Forgery Low 2018-07-19 – 9 A staff without export customers permissions can still export customers CSV file #860197 Valid Access Control – 2020-09-15 – 9 Subdomain Takeover of multiple *.ttcdn.co domains #915649 Valid Misconfiguration and Insecure Design Low 2020-07-14 – 9 [h1-2102] Stored XSS in product description via `productUpdate` GraphQL query leads to XSS at handshake-web-internal.shopifycloud.com/products/[ID] #1085546 Valid Cross-site Scripting Medium 2022-07-11 $1,600 9 SSRF via 'Add Image from URL' feature #67377 Valid Misconfiguration and Insecure Design – 2015-07-15 – 10 Reflected XSS in cart at hardware.shopify.com #95089 Valid Cross-site Scripting – 2015-12-22 $500 10 An administrator without any permission is able to get order notifications using his APNS Token. #100938 Valid Authentication – 2015-12-14 $500 10 H1514 Wholesale customer without checkout permission can complete purchases #423546 Valid Access Control Medium 2019-04-10 – 10 Privilege Escalation in Point Of Sale Application from POS Manage Staff Role to potentially Store Owner #985150 Valid No weakness recorded Medium 2020-11-19 – 10 XSS stored in the Shopify Email app #1033882 Valid Cross-site Scripting Low 2020-11-19 – 10 [CSRF] Install premium themes #103351 Valid Cross-Site Request Forgery – 2016-07-27 – 11 password less login token expiration issue #172837 Valid Authentication – 2016-10-19 $500 11 H1514 Shopify API ruby SDK session setup lacks input validation, resulting in SSRF and leakage of client secret #423437 Valid Input Validation and Logic None 2019-04-05 – 11