STAFF member with NO Explicit permissions can view `ActivityFeed` via GraphQL Analysed #528940 Valid Access Control Low 2019-06-18 $500 23 [h1-2102] [Plus] User with Store Management Permission can Make changeDomainEnforcementState - that should be limited to User Management Only Analysed #1084892 Valid Access Control Medium 2022-04-21 – 23 Apache Flink Dashboard exposure at https://streaming-sales-model-production.flink.shopifykloud.com Analysed #1262907 Valid Information Disclosure None 2021-11-18 – 23 H1514 Extract information about other sites (new sites) through Affiliate/Referral pages Analysed #423506 Valid Information Disclosure Medium 2019-11-04 – 24 Bypass GraphQL rate limit by abusing negative cost queries Analysed #481518 Valid Input Validation and Logic Low 2019-01-24 – 24 Low Privileged Staff Member Can Export Billing Charges Analysed #1010835 Valid Access Control Medium 2020-11-26 $1,900 24 H1514 Simple phishing using auto-created modal with weak URL-pattern check in incontext_app_link Analysed #422279 Valid Input Validation and Logic Medium 2019-04-10 – 25 xss triggered in "myshopify.com/admin/product" Analysed #978125 Valid No weakness recorded High 2020-09-15 – 25 Staff with no permissions can listen to Shopify Ping conversations by registering to its different WebSocket Events Analysed #1023669 Valid Information Disclosure – 2020-11-19 – 25 Is the Google Bucket Meant To Be Publicly Listable? https://cdn.shopify.com/shop-assets/ Analysed #1102546 Valid No weakness recorded None 2022-02-09 – 25 Stealing users' facebook access tokens - kitcrm.com Analysed #211477 Valid Information Disclosure – 2017-03-15 – 26 [ux.shopify.com] Subdomain takeover Analysed #221631 Valid Access Control Medium 2018-10-19 – 26 Preview bar: Incomplete message origin validation results in XSS Analysed #381192 Valid Cross-site Scripting Medium 2018-07-26 – 26 user with no draft order permission can still perform action on draft order's in stocky app (idor) Analysed #802286 Valid Authentication – 2020-07-14 – 26 None permission staff member can identify installed application and products attached to it Analysed #848625 Valid Information Disclosure Low 2020-04-21 $500 26 Ability to generate shipping labels in another store orders Analysed #884159 Valid Insecure Direct Object Reference – 2020-08-19 – 26 Stored XSS on apps.shopify.com Analysed #1107726 Valid Cross-site Scripting Medium 2021-04-08 – 26 Staff can use BULK_OPERATIONS_FINISH webhook topic using Graphql without permissions all Analysed #1350095 Valid Access Control Medium 2021-12-04 – 26 Sidekiq dashboard exposed at notary.shopifycloud.com Analysed #1405673 Valid Information Disclosure Medium 2021-11-25 – 26 Direct Access To admin Dashboard Analysed #1421804 Valid Authentication None 2022-01-20 – 26 Staff can create workflows in Shopify Admin without apps permission Analysed #1521336 Valid Access Control Medium 2022-10-13 – 26 subdomain Takeover at blog.exchangemarketplace.com Analysed #416474 Valid No weakness recorded Low 2018-10-01 – 27 Stored - XSS Analysed #532643 Valid Cross-site Scripting Medium 2019-05-28 – 27 XSS seems to work again after change to linkpop at https://linkpop.com/testnaglinagli Analysed #1569940 Valid Cross-site Scripting Medium 2022-10-13 – 27 Attention! Remote Code Execution at http://wpt.ec2.shopify.com/ Analysed #73567 Valid Command and Code Injection – 2015-07-16 – 28 Open redirect in bulk edit Analysed #169759 Valid Open Redirect – 2016-12-04 – 28 Bypass report #416983 - Removed Staff members who had "Apps" permission can still modify flow app connections Analysed #698708 Valid Access Control Medium 2019-10-10 – 28 GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior) #2886723 Informative Information Disclosure None 2025-09-17 – 28 IDOR expire other user sessions Analysed #56511 Valid Authentication – 2015-04-17 $1,000 29 Potentially Sensitive Information on GitHub Analysed #143438 Valid Information Disclosure – 2016-07-17 – 29 Path Traversal in App Proxy Analysed #869888 Valid File and Path Handling Medium 2020-08-24 – 29 Ability to connect an external login service for unverified emails/accounts at accounts.shopify.com Analysed #1018489 Valid Authentication Medium 2022-04-13 $1,600 29 Self xss in product reviews Analysed #1029668 Valid Cross-site Scripting Medium 2020-11-19 – 29 Senseitive data Related to Shopify Host -> https://shopify.zendesk.com/ Analysed #1298809 Valid Cryptography None 2021-11-08 – 29 Open Redirect at *.myshopify.com/account/login?checkout_url= Analysed #103772 Valid Open Redirect – 2015-12-16 – 30 Stored XSS in https://productreviews.shopifyapps.com/proxy/v4/reviews/product Analysed #168458 Valid Cross-site Scripting – 2019-11-08 – 30 CSRF in all API endpoints when authenticated using HTTP Authentication Analysed #195156 Valid Cross-Site Request Forgery – 2017-03-28 – 30 XSS in $shop$.myshopify.com/admin/ via "Button Objects" in malicious app Analysed #217745 Valid Cross-site Scripting High 2017-05-22 $800 30 H1514 Deanonymizing Exchange Marketplace private listings Analysed #421009 Valid Information Disclosure Medium 2020-03-10 $1,000 30 any staff members have the ability to comment in [discounts] he/she can disable comment section it to other staff even the admin of the store Analysed #629150 Valid Access Control Low 2019-07-15 – 30 Fetching external resources through svg images Analysed #142709 Valid Information Disclosure – 2016-06-21 – 31 XSS in $shop$.myshopify.com/admin/ via twine template injection in "Shopify.API.Modal.input" method when using a malicious app Analysed #217790 Valid Cross-site Scripting High 2017-06-01 $1,000 31 [h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserRole Analysed #1084638 Valid Access Control Medium 2022-04-21 – 31 Shop App - Attacker is able to intercept authorization code during authentication (OAuth) and is able to get access to Microsoft Outlook email account Analysed #1700734 Valid Authentication Low 2023-03-02 $900 31 XSS on "widgets.shopifyapps.com" via "stripping" attribute and "shop" parameter Analysed #246794 Valid Cross-site Scripting None 2018-04-03 $1,000 32 Ability to see password protected content by bypassing the password page of shopify preview URL for new development stores (as of August 17, 2020) Analysed #961929 Valid Information Disclosure Medium 2020-08-25 $1,500 32 Add new managed stores without permission Analysed #1167753 Valid Access Control Medium 2021-07-08 – 32 IDOR [partners.shopify.com] - User with ONLY Manage apps permission is able to get shops info and staff names from inside the shop Analysed #243943 Valid Insecure Direct Object Reference Medium 2017-07-19 $500 33 Cross-site scripting in "Contact customer" form Analysed #294505 Valid Cross-site Scripting Low 2017-12-19 – 33 [Privilege Escalation] Shopify Admin -- Permission from Settings to Customer Analysed #541606 Valid No weakness recorded Low 2019-07-05 – 33