Takeover an account that doesn't have a Shopify ID and more Analysed #867513 Valid No weakness recorded Critical 2020-09-02 – 3,006 Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSO Analysed #791775 Valid No weakness recorded Critical 2020-04-01 – 1,922 [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation Analysed #796808 Valid No weakness recorded Critical 2020-04-01 – 894 H1514 Remote Code Execution on kitcrm using bulk customer update of Priority Products Analysed #422944 Valid Command and Code Injection Medium 2020-02-06 – 830 Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalation Analysed #910300 Valid Access Control Critical 2020-09-15 – 559 Shopify Stocky App OAuth Misconfiguration Analysed #740989 Valid Access Control Medium 2019-12-11 – 527 H1514 Server Side Template Injection in Return Magic email templates? Analysed #423541 Valid Command and Code Injection – 2019-04-04 – 409 H1514 Ability to MiTM Shopify PoS Session to Takeover Communications Analysed #423467 Valid Input Validation and Logic Medium 2019-11-04 – 372 XSS while logging using Google Analysed #691611 Valid Cross-site Scripting – 2019-09-11 $1,750 341 Stored XSS in my staff name fired in another your internal panel Analysed #946053 Valid Cross-site Scripting High 2020-07-29 – 326 Shopify admin authentication bypass using partners.shopify.com Analysed #270981 Valid Access Control Critical 2017-09-28 – 311 Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation Analysed #796956 Valid No weakness recorded Medium 2020-04-01 – 310 Ability to bypass partner email confirmation to take over any store given an employee email Analysed #300305 Valid Race Conditions Critical 2018-02-07 $15,250 273 Shopify Partners Invitation Process Allows Privilege Escalation Without Email Verification Analysed #2885269 Valid Access Control Medium 2025-05-15 – 245 H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie Stuffing Analysed #422043 Valid Cross-site Scripting High 2019-04-17 – 195 IDOR on GraphQL queries BillingDocumentDownload and BillDetails Analysed #2207248 Valid Insecure Direct Object Reference Medium 2024-02-08 $5,000 187 Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.com Analysed #1457471 Valid Access Control Medium 2025-03-20 – 181 GraphQL AdminGenerateSessionPayload is leaked to staff with no permission Analysed #898528 Valid No weakness recorded Medium 2020-07-16 – 173 [h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034) Analysed #1086108 Valid Access Control Medium 2021-03-25 $3,100 166 Undocumented `fileCopy` GraphQL API Analysed #981472 Valid Access Control Medium 2020-10-22 $2,000 157 Session works after logout from Shopify account and password of online store is displayed Analysed #837729 Valid No weakness recorded Low 2020-04-27 – 157 Stored XSS in SVG file as data: url Analysed #1276742 Valid Cross-site Scripting Medium 2023-01-31 $5,300 153 User with removed manage shops permissions is still able to make changes to a shop Analysed #273099 Valid Access Control Medium 2020-06-12 – 145 HTTP Response Header Injection in shopify/pitchfork + Rack 3 Analysed #2279572 Valid Injection and Smuggling Low 2025-03-27 $800 136 [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image Analysed #1021906 Valid Information Disclosure Medium 2020-11-21 $2,900 135 Create free Shopify application credits. Analysed #1257428 Valid Access Control Medium 2021-09-10 – 134 Disclose Any Store products, Files, Purchase Orders Via Email through Shopify Stocky APP Analysed #763994 Valid Access Control – 2020-02-02 – 116 Stored XSS in Shopify Chat Analysed #756729 Valid Cross-site Scripting Low 2019-12-23 $500 106 Bypass a fix for report #708013 Analysed #1363672 Valid Authentication Medium 2021-12-07 $3,500 102 Ability to publish a paid theme without purchasing it. Analysed #953083 Valid Access Control Low 2020-08-27 $2,000 90 Bypass of biometrics security functionality is possible in Android application (com.shopify.mobile) Analysed #637194 Valid Authentication Low 2019-08-14 $500 90 Reverse Proxy misroute leading to steal X-Shopify-Access-Token header Analysed #429617 Valid Server-Side Request Forgery Medium 2019-03-14 $1,000 90 Add new development stores without permission Analysed #1167453 Valid Access Control Medium 2021-06-04 – 89 URL Path Manipulation Enables Cache Poisoning of Amazon Affiliate Products in Shopify Linkpop Analysed #1848940 Valid Other weaknesses Low 2025-08-14 $500 88 XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applications Analysed #232174 Valid Cross-site Scripting High 2017-06-27 $5,000 88 No Session Expiry after log-out, attacker can reuse the old cookies Analysed #1162443 Valid Authentication Low 2024-05-01 $500 87 Ability to link a Google account to another staff account/store owner that isn't linked yet Analysed #892904 Valid No weakness recorded – 2020-07-14 – 84 SVG Server Side Request Forgery (SSRF) Analysed #223203 Valid Server-Side Request Forgery Low 2017-09-22 $500 81 Stored XSS in /admin/product and /admin/collections Analysed #1147433 Valid Cross-site Scripting Medium 2022-12-01 $5,300 76 ██████ DOM XSS via Shopify.API.remoteRedirect Analysed #646505 Valid Cross-site Scripting Low 2019-09-15 – 76 Ability to verify any email address you don't own - accounts.shopify.com Analysed #229619 Valid Misconfiguration and Insecure Design – 2019-11-08 – 76 xss stored Analysed #798599 Valid Cross-site Scripting – 2020-04-03 – 75 A staff member with no permissions can edit Store Customer Email Analysed #980511 Valid Insecure Direct Object Reference Medium 2020-10-22 $1,500 72 myshopify.com domain takeover Analysed #320355 Valid Input Validation and Logic Medium 2018-02-27 – 71 POST-based XSS on apps.shopify.com Analysed #429679 Valid Cross-site Scripting Low 2019-03-14 $500 69 Session works after logout from Shopify account Analysed #340191 Valid Race Conditions Low 2020-03-30 – 69 Stored XSS through Facebook Page Connection Analysed #267570 Valid Cross-site Scripting Low 2020-04-04 – 68 A non-privileged user may create an admin account in Stocky Analysed #1245736 Valid Access Control Medium 2021-11-25 – 67 Staff without Manage Themes permissions can update themes Analysed #1550400 Valid No weakness recorded Medium 2024-01-23 – 66 URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript Execution Analysed #1737358 Valid Access Control Low 2025-09-17 – 65