OrderListInitial leaks order details #882412 Valid Information Disclosure Medium 2020-08-18 $1,500 2 Get analytics token using only apps permission #901775 Valid Information Disclosure Medium 2020-08-18 – 3 XSS in my.shopify.com in widget #185826 Valid Cross-site Scripting Medium 2017-07-21 $500 5 Subdomain takeover in help.tictail.com pointing to Zendesk (a Shopify acquisition) #869605 Valid Access Control Medium 2020-08-24 – 5 increased privileges on staff account #911857 Valid No weakness recorded Medium 2020-08-24 – 5 STAFF "No-Permissions" on the Store can retrieve the details Order via exchangeReceiptSend #917875 Valid Information Disclosure Medium 2020-08-24 $1,000 6 Stored passive XSS at scheduled posts (kitcrm.com) #214581 Valid Cross-site Scripting Medium 2017-03-28 – 7 access permission is not revoked even if the email has been deleted or changed on the partner account -partners.shopify- #870001 Valid No weakness recorded Medium 2020-08-18 – 7 [out-of-scope] toxiproxy: Lack of CSRF protection allows an attacker to gain access to internal Shopify network #236349 Valid Server-Side Request Forgery Medium 2018-07-11 – 8 store internal email disclosed through shopify-data-exporter #1605962 Valid Information Disclosure Medium 2022-09-15 – 8 [h1-2102] Stored XSS in product description via `productUpdate` GraphQL query leads to XSS at handshake-web-internal.shopifycloud.com/products/[ID] #1085546 Valid Cross-site Scripting Medium 2022-07-11 $1,600 9 H1514 Wholesale customer without checkout permission can complete purchases #423546 Valid Access Control Medium 2019-04-10 – 10 Privilege Escalation in Point Of Sale Application from POS Manage Staff Role to potentially Store Owner #985150 Valid No weakness recorded Medium 2020-11-19 – 10 [h1-2102] [Plus] User with Store Management Permission can Make convertUsersFromSaml/convertUsersToSaml - that should be limited to User Management #1084904 Valid Access Control Medium 2022-04-21 – 11 Open Redirect in www.shopify.dev Environment #842035 Valid Open Redirect Medium 2021-11-18 – 12 Stored XSS in *.myshopify.com #241008 Valid Cross-site Scripting Medium 2017-06-27 – 13 Add store to new partner account without confirming email address. #633371 Valid Access Control Medium 2020-01-02 – 13 IDOR on stocky application-Low Stock-Varient-Settings-Columns #853130 Valid Insecure Direct Object Reference Medium 2020-07-14 $750 13 SQL Exception thrown during product import #237597 Valid Information Disclosure Medium 2017-07-12 – 14 your-store.myshopify.com preview link is leak on third party website lead to preview all action from store owner Without store Password. #997350 Valid Authentication Medium 2021-07-12 $500 14 XSS on postal codes #192140 Valid Cross-site Scripting Medium 2017-01-11 – 15 [h1-2102] [PLUS] User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only #1084939 Valid Access Control Medium 2022-04-21 – 15 stored xss in invited team member via email parameter #267177 Valid Cross-site Scripting Medium 2017-11-03 $500 16 Cross Site Scripting at https://app.oberlo.com/ #542258 Valid Cross-site Scripting Medium 2019-05-26 – 16 Read/Write arbitrary (non-HttpOnly) cookies on checkout pages via GoogleAnalyticsAdditionalScripts postMessage handler #1081167 Valid Cross-site Scripting Medium 2022-12-01 $1,600 17 Open Redirect on Login Page of Stocky App #1087189 Valid Open Redirect Medium 2021-02-11 – 17 [h1-2102] Partner's team member with no permission can retrieve services financial data #1091380 Valid Access Control Medium 2021-04-08 – 17 [h1-2102] Information disclosure - ShopifyPlus add user displays existing Shopify ID fullname #1083922 Valid Information Disclosure Medium 2022-02-10 – 18 Staff Member can Get POS Access Without User Interaction #1018094 Valid No weakness recorded Medium 2020-11-19 – 19 Access to Private Photos of Apps in App section(IDOR) #318751 Valid Insecure Direct Object Reference Medium 2018-03-05 – 20 XSS on manually entering Postal codes #190951 Valid Cross-site Scripting Medium 2016-12-17 $500 21 H1514 Stored XSS in Return Magic App portal content #420459 Valid Cross-site Scripting Medium 2019-11-08 – 21 H1514 Stored XSS on Wholesale sales channel allows cross-organization data leakage #423454 Valid Cross-site Scripting Medium 2019-11-01 – 21 Disconnecting an external login provider does not revoke session #1547684 Valid Authentication Medium 2022-12-01 $1,600 21 Admin bar: Incomplete message origin validation results in XSS Analysed #387544 Valid Cross-site Scripting Medium 2018-11-07 – 23 [h1-2102] [Plus] User with Store Management Permission can Make changeDomainEnforcementState - that should be limited to User Management Only Analysed #1084892 Valid Access Control Medium 2022-04-21 – 23 H1514 Extract information about other sites (new sites) through Affiliate/Referral pages Analysed #423506 Valid Information Disclosure Medium 2019-11-04 – 24 Low Privileged Staff Member Can Export Billing Charges Analysed #1010835 Valid Access Control Medium 2020-11-26 $1,900 24 H1514 Simple phishing using auto-created modal with weak URL-pattern check in incontext_app_link Analysed #422279 Valid Input Validation and Logic Medium 2019-04-10 – 25 [ux.shopify.com] Subdomain takeover Analysed #221631 Valid Access Control Medium 2018-10-19 – 26 Preview bar: Incomplete message origin validation results in XSS Analysed #381192 Valid Cross-site Scripting Medium 2018-07-26 – 26 Stored XSS on apps.shopify.com Analysed #1107726 Valid Cross-site Scripting Medium 2021-04-08 – 26 Staff can use BULK_OPERATIONS_FINISH webhook topic using Graphql without permissions all Analysed #1350095 Valid Access Control Medium 2021-12-04 – 26 Sidekiq dashboard exposed at notary.shopifycloud.com Analysed #1405673 Valid Information Disclosure Medium 2021-11-25 – 26 Staff can create workflows in Shopify Admin without apps permission Analysed #1521336 Valid Access Control Medium 2022-10-13 – 26 Stored - XSS Analysed #532643 Valid Cross-site Scripting Medium 2019-05-28 – 27 XSS seems to work again after change to linkpop at https://linkpop.com/testnaglinagli Analysed #1569940 Valid Cross-site Scripting Medium 2022-10-13 – 27 Bypass report #416983 - Removed Staff members who had "Apps" permission can still modify flow app connections Analysed #698708 Valid Access Control Medium 2019-10-10 – 28 Path Traversal in App Proxy Analysed #869888 Valid File and Path Handling Medium 2020-08-24 – 29 Ability to connect an external login service for unverified emails/accounts at accounts.shopify.com Analysed #1018489 Valid Authentication Medium 2022-04-13 $1,600 29