Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Reflected XSSAnalysed#569241 | Valid | Cross-site Scripting | Low | 2019-05-28 | – | 48 |
| Shopify.com Web Cache Deception vulnerability leads to personal information and CSRF tokens leakageAnalysed#1271944 | Valid | Misconfiguration and Insecure Design | Low | 2021-10-21 | $800 | 48 |
| ability to install paid themes for freeAnalysed#273557 | Valid | Access Control | Medium | 2018-05-16 | – | 50 |
| XSS within Shopify Email App - AdminAnalysed#869831 | Valid | Cross-site Scripting | – | 2020-09-14 | – | 50 |
| Bypass of fix #1370749Analysed#1489077 | Valid | Access Control | Low | 2022-04-22 | $900 | 50 |
| Inject page in admin panel via Shopify.API.pushStateAnalysed#662083 | Valid | Cross-site Scripting | Low | 2019-09-09 | $500 | 51 |
| [h1-2102] [Oberlo] Least privileged user can cancel account owner's subscription via POST on /payments/subscribeAnalysed#1084865 | Valid | Access Control | Low | 2024-01-17 | – | 51 |
| Cross-site scripting on api.collabs.shopify.comAnalysed#1672459 | Valid | Cross-site Scripting | Medium | 2022-10-13 | $1,600 | 51 |
| Stored xssAnalysed#415484 | Valid | Cross-site Scripting | High | 2018-11-07 | $1,000 | 52 |
| EC2 Takeover at turn.shopify.comAnalysed#1295497 | Valid | Cross-site Scripting | Low | 2022-03-28 | – | 52 |
| Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permissionAnalysed#700831 | Valid | Input Validation and Logic | Medium | 2019-10-10 | – | 53 |
| Staff who only have apps and channels permission can do a takeover account at the wholesale store (Bypass get invitation link)Analysed#1266828 | Valid | No weakness recorded | Medium | 2021-11-21 | $1,600 | 53 |
| Stored XSS at https://linkpop.comAnalysed#1441988 | Valid | Cross-site Scripting | Medium | 2022-01-20 | – | 53 |
| authenticity token not verfied leads to change business nameAnalysed#994504 | Valid | Cross-Site Request Forgery | Medium | 2020-10-23 | $1,900 | 54 |
| Stored XSS on activityAnalysed#391390 | Valid | Cross-site Scripting | High | 2018-08-14 | $2,000 | 55 |
| Self XSSAnalysed#982510 | Valid | Cross-site Scripting | – | 2020-09-17 | $500 | 55 |
| SSRF in hatchful.shopify.comAnalysed#409701 | Valid | Server-Side Request Forgery | Low | 2019-04-04 | $500 | 56 |
| staff can able to extend shopify trial period without admin permissionAnalysed#947728 | Valid | Access Control | Low | 2020-09-15 | – | 56 |
| H1514 [beerify.shopifycloud.com] GraphQL discloses internal beer consumptionAnalysed#419883 | Valid | Information Disclosure | None | 2019-05-08 | $802 | 57 |
| Reflected XSS on $Any$.myshopify.com/adminAnalysed#422707 | Valid | Cross-site Scripting | High | 2018-11-13 | $1,500 | 58 |
| XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.comAnalysed#964550 | Valid | Misconfiguration and Insecure Design | Low | 2020-08-30 | – | 58 |
| Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store!Analysed#1044285 | Valid | No weakness recorded | Medium | 2021-07-08 | $2,900 | 58 |
| Non-store owners can transfer Shopify-managed domain to another domain providerAnalysed#1820953 | Valid | Access Control | Medium | 2024-01-17 | – | 58 |
| Open redirect using theme installAnalysed#101962 | Valid | Open Redirect | – | 2015-12-14 | – | 61 |
| Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypassAnalysed#397130 | Valid | Authentication | Critical | 2018-09-19 | – | 61 |
| Using GraphQL, STAFF with NO explicit permissions on Store can retrieve Shopify Payments Balance.Analysed#417170 | Valid | Information Disclosure | Low | 2019-04-04 | $500 | 62 |
| Insufficient session expiration in the **com.shopify.ping** android appAnalysed#1172205 | Valid | Authentication | Low | 2021-11-26 | – | 63 |
| Xss triggered in Your-store.myshopify.com/admin/apps/shopify-email/editor/****Analysed#1472471 | Valid | Cross-site Scripting | Medium | 2022-04-25 | $2,900 | 63 |
| Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)#3161827 | Informative | Authentication | None | 2025-09-04 | – | 63 |
| Disclose customer orders details by shopify chat application.Analysed#968165 | Valid | Information Disclosure | Medium | 2022-05-14 | $2,500 | 65 |
| Ability to Disable the Login Attempt of any Shopify Owner for 24 hrs (Zero_Click)Analysed#1406495 | Valid | Input Validation and Logic | Low | 2022-02-15 | $900 | 65 |
| URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript ExecutionAnalysed#1737358 | Valid | Access Control | Low | 2025-09-17 | – | 65 |
| Shopify GitHub Login and Password exposed all private source code might be available.Analysed#124100 | Valid | Information Disclosure | – | 2017-06-08 | $1,500 | 66 |
| Staff without Manage Themes permissions can update themesAnalysed#1550400 | Valid | No weakness recorded | Medium | 2024-01-23 | – | 66 |
| Cache poisoning via X-Forwarded-Host in www.shopify.com/partners/blogAnalysed#977851 | Valid | Injection and Smuggling | Low | 2020-09-11 | $1,000 | 67 |
| A non-privileged user may create an admin account in StockyAnalysed#1245736 | Valid | Access Control | Medium | 2021-11-25 | – | 67 |
| Stored XSS through Facebook Page ConnectionAnalysed#267570 | Valid | Cross-site Scripting | Low | 2020-04-04 | – | 68 |
| Subdomain Takeover Via unclaimed Heroku Instance tim-exclusive.shopify.comAnalysed#424669 | Valid | Authentication | – | 2021-02-24 | $500 | 68 |
| Reflected XSS in <any>.myshopify.com through theme previewAnalysed#226428 | Valid | Cross-site Scripting | – | 2017-05-29 | – | 69 |
| Session works after logout from Shopify accountAnalysed#340191 | Valid | Race Conditions | Low | 2020-03-30 | – | 69 |
| POST-based XSS on apps.shopify.comAnalysed#429679 | Valid | Cross-site Scripting | Low | 2019-03-14 | $500 | 69 |
| xss is triggered on your webAnalysed#1121900 | Valid | Cross-site Scripting | Medium | 2021-12-06 | – | 69 |
| Stealing livechat token and using it to chat as the user - user information disclosureAnalysed#151058 | Valid | Authentication | – | 2016-07-19 | – | 71 |
| myshopify.com domain takeoverAnalysed#320355 | Valid | Input Validation and Logic | Medium | 2018-02-27 | – | 71 |
| help.shopify.com Cross Site ScriptingAnalysed#564196 | Valid | Cross-site Scripting | Low | 2019-05-12 | – | 71 |
| A staff member with no permissions can edit Store Customer EmailAnalysed#980511 | Valid | Insecure Direct Object Reference | Medium | 2020-10-22 | $1,500 | 72 |
| CircleCI token in github repo allows for access to sensitive build informationAnalysed#858915 | Valid | Information Disclosure | – | 2020-09-15 | – | 74 |
| Blind Stored XSS in shopify internal Parquet ViewerAnalysed#1103298 | Valid | Cross-site Scripting | Medium | 2024-02-08 | – | 74 |
| Stored XSS in Discounts sectionAnalysed#618031 | Valid | Cross-site Scripting | Medium | 2019-06-27 | $1,000 | 75 |
| xss storedAnalysed#798599 | Valid | Cross-site Scripting | – | 2020-04-03 | – | 75 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.