OrderListInitial leaks order details #882412 Valid Information Disclosure Medium 2020-08-18 $1,500 2 Get analytics token using only apps permission #901775 Valid Information Disclosure Medium 2020-08-18 – 3 Some store settings/data are accessible to "No Access" permission users on GraphQL LiveView operation #409973 Valid Information Disclosure – 2020-08-18 – 4 *.shopify.com - Authentication bypass #838231 Valid No weakness recorded – 2020-08-24 – 5 Subdomain takeover in help.tictail.com pointing to Zendesk (a Shopify acquisition) #869605 Valid Access Control Medium 2020-08-24 – 5 increased privileges on staff account #911857 Valid No weakness recorded Medium 2020-08-24 – 5 STAFF "No-Permissions" on the Store can retrieve the details Order via exchangeReceiptSend #917875 Valid Information Disclosure Medium 2020-08-24 $1,000 6 access permission is not revoked even if the email has been deleted or changed on the partner account -partners.shopify- #870001 Valid No weakness recorded Medium 2020-08-18 – 7 Admin web sessions remain active after logout of Shopify ID #952035 Valid Authentication – 2020-09-14 – 7 Partner's non-verified business email change reflected into Shopify Collaborator Request #874574 Valid Access Control – 2020-09-14 – 8 Stocky App Administrator can create a backdoor admin account by using an existing POS User #962895 Valid No weakness recorded – 2020-08-24 – 8 damage to the timeline so that comment fields cannot be displayed or not available to all members in the store #971599 Valid No weakness recorded – 2020-09-09 – 8 Order lookup features of Shopify Chat Application leads to customer orders enumeration due to lack of user input validation #1017576 Valid No weakness recorded – 2020-11-19 – 8 Customer's full name disclosure via Shopify Chat (by email lookup) #1018336 Valid Information Disclosure – 2020-11-19 – 8 A staff without export customers permissions can still export customers CSV file #860197 Valid Access Control – 2020-09-15 – 9 Subdomain Takeover of multiple *.ttcdn.co domains #915649 Valid Misconfiguration and Insecure Design Low 2020-07-14 – 9 Privilege Escalation in Point Of Sale Application from POS Manage Staff Role to potentially Store Owner #985150 Valid No weakness recorded Medium 2020-11-19 – 10 XSS stored in the Shopify Email app #1033882 Valid Cross-site Scripting Low 2020-11-19 – 10 Password protection can be removed for newly created development store #965510 Valid No weakness recorded – 2020-09-14 – 11 Add store to new partner account without confirming email address. #633371 Valid Access Control Medium 2020-01-02 – 13 IDOR on stocky application-Low Stock-Varient-Settings-Columns #853130 Valid Insecure Direct Object Reference Medium 2020-07-14 $750 13 Staff member with no permission can delete POS staff from account settings Analysed #860348 Valid Access Control Low 2020-09-14 $500 14 Self XSS in Timeline Analysed #854299 Valid Cross-site Scripting – 2020-08-25 – 16 Open Redirect - www.shopify.com Analysed #905737 Valid Open Redirect Low 2020-07-14 – 17 Staff Member can Get POS Access Without User Interaction Analysed #1018094 Valid No weakness recorded Medium 2020-11-19 – 19 Inject page in admin panel via Shopify.API.pushState [New Payload] Analysed #883867 Valid Cross-site Scripting Low 2020-12-27 $500 20 Password reset link not expired at Stocky App Analysed #898841 Valid Access Control – 2020-08-18 – 21 XSS / SELF XSS Analysed #906201 Valid Cross-site Scripting Low 2020-09-14 – 21 Ability to publish a paid theme without purchasing it. Analysed #927567 Valid Access Control Low 2020-08-27 $2,000 21 H1514 CSRF in Domain transfer allows adding your domain to other user's account Analysed #416978 Valid Cross-Site Request Forgery High 2020-03-30 – 23 Low Privileged Staff Member Can Export Billing Charges Analysed #1010835 Valid Access Control Medium 2020-11-26 $1,900 24 xss triggered in "myshopify.com/admin/product" Analysed #978125 Valid No weakness recorded High 2020-09-15 – 25 Staff with no permissions can listen to Shopify Ping conversations by registering to its different WebSocket Events Analysed #1023669 Valid Information Disclosure – 2020-11-19 – 25 user with no draft order permission can still perform action on draft order's in stocky app (idor) Analysed #802286 Valid Authentication – 2020-07-14 – 26 None permission staff member can identify installed application and products attached to it Analysed #848625 Valid Information Disclosure Low 2020-04-21 $500 26 Ability to generate shipping labels in another store orders Analysed #884159 Valid Insecure Direct Object Reference – 2020-08-19 – 26 Path Traversal in App Proxy Analysed #869888 Valid File and Path Handling Medium 2020-08-24 – 29 Self xss in product reviews Analysed #1029668 Valid Cross-site Scripting Medium 2020-11-19 – 29 H1514 Deanonymizing Exchange Marketplace private listings Analysed #421009 Valid Information Disclosure Medium 2020-03-10 $1,000 30 Ability to see password protected content by bypassing the password page of shopify preview URL for new development stores (as of August 17, 2020) Analysed #961929 Valid Information Disclosure Medium 2020-08-25 $1,500 32 Account takeover intercepting magic link for Arrive app Analysed #855618 Valid Authentication Low 2020-07-15 – 33 Script Editor preview token still working with uninstalled application, even for unpublished script Analysed #915940 Valid No weakness recorded – 2020-08-25 – 33 Timeline Editor Self-XSS (Previous Fix #738072 Incomplete) Analysed #755679 Valid Cross-site Scripting Low 2020-03-16 $500 35 Stored XSS on demo app link Analysed #439912 Valid Cross-site Scripting Medium 2020-06-12 – 37 Inject page in admin panel via Shopify.API.pushState with protocol invalid Analysed #868615 Valid Cross-site Scripting Low 2020-12-27 $500 39 User sensitive information disclosure Analysed #975047 Valid Information Disclosure Medium 2020-10-22 $1,000 40 Blind Stored XSS Via Staff Name Analysed #948929 Valid Cross-site Scripting High 2020-08-18 $3,000 45 xss stored in https://your store.myshopify.com/admin/ Analysed #887879 Valid Cross-site Scripting Low 2020-08-24 $1,000 46 XSS within Shopify Email App - Admin Analysed #869831 Valid Cross-site Scripting – 2020-09-14 – 50 authenticity token not verfied leads to change business name Analysed #994504 Valid Cross-Site Request Forgery Medium 2020-10-23 $1,900 54