Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| SSRF in hatchful.shopify.comAnalysed#409701 | Valid | Server-Side Request Forgery | Low | 2019-04-04 | $500 | 56 |
| Self XSSAnalysed#982510 | Valid | Cross-site Scripting | – | 2020-09-17 | $500 | 55 |
| Stored XSS on activityAnalysed#391390 | Valid | Cross-site Scripting | High | 2018-08-14 | $2,000 | 55 |
| authenticity token not verfied leads to change business nameAnalysed#994504 | Valid | Cross-Site Request Forgery | Medium | 2020-10-23 | $1,900 | 54 |
| Stored XSS at https://linkpop.comAnalysed#1441988 | Valid | Cross-site Scripting | Medium | 2022-01-20 | – | 53 |
| Staff who only have apps and channels permission can do a takeover account at the wholesale store (Bypass get invitation link)Analysed#1266828 | Valid | No weakness recorded | Medium | 2021-11-21 | $1,600 | 53 |
| Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permissionAnalysed#700831 | Valid | Input Validation and Logic | Medium | 2019-10-10 | – | 53 |
| EC2 Takeover at turn.shopify.comAnalysed#1295497 | Valid | Cross-site Scripting | Low | 2022-03-28 | – | 52 |
| Stored xssAnalysed#415484 | Valid | Cross-site Scripting | High | 2018-11-07 | $1,000 | 52 |
| Cross-site scripting on api.collabs.shopify.comAnalysed#1672459 | Valid | Cross-site Scripting | Medium | 2022-10-13 | $1,600 | 51 |
| [h1-2102] [Oberlo] Least privileged user can cancel account owner's subscription via POST on /payments/subscribeAnalysed#1084865 | Valid | Access Control | Low | 2024-01-17 | – | 51 |
| Inject page in admin panel via Shopify.API.pushStateAnalysed#662083 | Valid | Cross-site Scripting | Low | 2019-09-09 | $500 | 51 |
| Bypass of fix #1370749Analysed#1489077 | Valid | Access Control | Low | 2022-04-22 | $900 | 50 |
| XSS within Shopify Email App - AdminAnalysed#869831 | Valid | Cross-site Scripting | – | 2020-09-14 | – | 50 |
| ability to install paid themes for freeAnalysed#273557 | Valid | Access Control | Medium | 2018-05-16 | – | 50 |
| Shopify.com Web Cache Deception vulnerability leads to personal information and CSRF tokens leakageAnalysed#1271944 | Valid | Misconfiguration and Insecure Design | Low | 2021-10-21 | $800 | 48 |
| Reflected XSSAnalysed#569241 | Valid | Cross-site Scripting | Low | 2019-05-28 | – | 48 |
| H1514 Bypass Wholesale account signup restrictionsAnalysed#423496 | Valid | Access Control | Medium | 2019-06-07 | – | 48 |
| apps.shopify.com - CSRF token leakage through Google AnalyticsAnalysed#196458 | Valid | Cross-Site Request Forgery | – | 2017-02-07 | – | 48 |
| Stored XSS in blog comments through Shopify APIAnalysed#192210 | Valid | Cross-site Scripting | Medium | 2017-03-16 | – | 48 |
| Able to Login deactivated staff account in shopify app mobileAnalysed#175490 | Valid | Access Control | – | 2016-11-29 | – | 48 |
| Collaborators and Staff members without all necessary permissions are able to create, edit and install custom appsAnalysed#1555502 | Valid | Access Control | Medium | 2022-07-11 | $1,900 | 46 |
| [h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilegeAnalysed#1091303 | Valid | Information Disclosure | Medium | 2021-04-08 | – | 46 |
| xss stored in https://your store.myshopify.com/admin/Analysed#887879 | Valid | Cross-site Scripting | Low | 2020-08-24 | $1,000 | 46 |
| H1514 DOM XSS on checkout.shopify.com via postMessage handler on /:id/sandbox/google_mapsAnalysed#423218 | Valid | Cross-site Scripting | Medium | 2019-11-04 | $500 | 46 |
| Blind Stored XSS Via Staff NameAnalysed#948929 | Valid | Cross-site Scripting | High | 2020-08-18 | $3,000 | 45 |
| Subdomain Takeover - https://competition.shopify.com/Analysed#365853 | Valid | Access Control | Medium | 2018-06-19 | – | 45 |
| H1514 Removed Staff members who had "Apps" permission can still modify flow app connectionsAnalysed#416983 | Valid | Access Control | Low | 2019-06-14 | – | 44 |
| XSS on services.shopify.comAnalysed#591786 | Valid | Cross-site Scripting | Low | 2019-06-14 | $500 | 43 |
| Authentication Bypass on Icinga monitoring serverAnalysed#143482 | Valid | Authentication | – | 2016-07-17 | – | 42 |
| Exposed Slinky Instance Admin PanelAnalysed#808762 | Valid | Authentication | None | 2021-01-16 | – | 41 |
| Disclosure of Github IssuesAnalysed#425719 | Valid | Information Disclosure | Medium | 2018-11-08 | – | 41 |
| User sensitive information disclosureAnalysed#975047 | Valid | Information Disclosure | Medium | 2020-10-22 | $1,000 | 40 |
| Misconfiguration in Two Factor AuthorisationAnalysed#178293 | Valid | No weakness recorded | – | 2016-12-17 | $1,500 | 40 |
| Inject page in admin panel via Shopify.API.pushState with protocol invalidAnalysed#868615 | Valid | Cross-site Scripting | Low | 2020-12-27 | $500 | 39 |
| Stored XSS on buy buttonAnalysed#397088 | Valid | Cross-site Scripting | Low | 2018-09-29 | $500 | 39 |
| App messaging can be hijacked by third-party websitesAnalysed#387279 | Valid | Misconfiguration and Insecure Design | Medium | 2018-11-07 | – | 39 |
| Potential to abuse pricing errors in saved cartsAnalysed#336131 | Valid | Input Validation and Logic | Medium | 2018-05-02 | – | 39 |
| Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KITAnalysed#909863 | Valid | Insecure Direct Object Reference | Medium | 2021-02-07 | – | 38 |
| StoreFront API allows for a brute force attack on customer login by not timing out ALL attemptsAnalysed#708013 | Valid | Authentication | Medium | 2019-10-07 | – | 38 |
| Replace other user files in Inbox messagesAnalysed#322661 | Valid | Insecure Direct Object Reference | Medium | 2018-05-01 | – | 38 |
| Removed staff members who had "Manage shops" permission can still create development storesAnalysed#254588 | Valid | Access Control | Medium | 2019-11-08 | – | 38 |
| Low Privileged user can add or remove cash to/from sales registerAnalysed#905543 | Valid | Access Control | Low | 2021-06-16 | – | 37 |
| Stored XSS on demo app linkAnalysed#439912 | Valid | Cross-site Scripting | Medium | 2020-06-12 | – | 37 |
| Tinymce 2.4.0Analysed#262230 | Valid | Cross-site Scripting | Medium | 2017-09-26 | $2,000 | 37 |
| (BYPASS) Open redirect and XSS in supporthiring.shopify.comAnalysed#158434 | Valid | Cross-Site Request Forgery | – | 2016-11-21 | – | 37 |
| One Click XSS in [www.shopify.com]Analysed#1563334 | Valid | Cross-site Scripting | – | 2022-07-13 | – | 36 |
| Race condition at create new LocationAnalysed#413759 | Valid | Input Validation and Logic | Low | 2018-10-05 | $500 | 36 |
| Stored XSS in [shop].myshopify.com/admin/orders/[id]Analysed#214044 | Valid | Cross-site Scripting | – | 2017-03-28 | – | 36 |
| mruby-engine: UAF in MRubyEngine#initialize enables local RCE#3679660 | Informative | No weakness recorded | None | 2026-04-24 | – | 35 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.