Stored XSS on apps.shopify.com Analysed #1107726 Valid Cross-site Scripting Medium 2021-04-08 – 26 Ability to generate shipping labels in another store orders Analysed #884159 Valid Insecure Direct Object Reference – 2020-08-19 – 26 None permission staff member can identify installed application and products attached to it Analysed #848625 Valid Information Disclosure Low 2020-04-21 $500 26 user with no draft order permission can still perform action on draft order's in stocky app (idor) Analysed #802286 Valid Authentication – 2020-07-14 – 26 Preview bar: Incomplete message origin validation results in XSS Analysed #381192 Valid Cross-site Scripting Medium 2018-07-26 – 26 [ux.shopify.com] Subdomain takeover Analysed #221631 Valid Access Control Medium 2018-10-19 – 26 Stealing users' facebook access tokens - kitcrm.com Analysed #211477 Valid Information Disclosure – 2017-03-15 – 26 Is the Google Bucket Meant To Be Publicly Listable? https://cdn.shopify.com/shop-assets/ Analysed #1102546 Valid No weakness recorded None 2022-02-09 – 25 Staff with no permissions can listen to Shopify Ping conversations by registering to its different WebSocket Events Analysed #1023669 Valid Information Disclosure – 2020-11-19 – 25 xss triggered in "myshopify.com/admin/product" Analysed #978125 Valid No weakness recorded High 2020-09-15 – 25 H1514 Simple phishing using auto-created modal with weak URL-pattern check in incontext_app_link Analysed #422279 Valid Input Validation and Logic Medium 2019-04-10 – 25 Low Privileged Staff Member Can Export Billing Charges Analysed #1010835 Valid Access Control Medium 2020-11-26 $1,900 24 Bypass GraphQL rate limit by abusing negative cost queries Analysed #481518 Valid Input Validation and Logic Low 2019-01-24 – 24 H1514 Extract information about other sites (new sites) through Affiliate/Referral pages Analysed #423506 Valid Information Disclosure Medium 2019-11-04 – 24 Apache Flink Dashboard exposure at https://streaming-sales-model-production.flink.shopifykloud.com Analysed #1262907 Valid Information Disclosure None 2021-11-18 – 23 [h1-2102] [Plus] User with Store Management Permission can Make changeDomainEnforcementState - that should be limited to User Management Only Analysed #1084892 Valid Access Control Medium 2022-04-21 – 23 STAFF member with NO Explicit permissions can view `ActivityFeed` via GraphQL Analysed #528940 Valid Access Control Low 2019-06-18 $500 23 H1514 CSRF in Domain transfer allows adding your domain to other user's account Analysed #416978 Valid Cross-Site Request Forgery High 2020-03-30 – 23 Admin bar: Incomplete message origin validation results in XSS Analysed #387544 Valid Cross-site Scripting Medium 2018-11-07 – 23 Subdomain Takeover in http://genghis-cdn.shopify.io/ pointing to Fastly Analysed #165309 Valid No weakness recorded – 2016-09-06 – 23 [h1-2102] HTML injection in packing slips can lead to physical theft Analysed #1087122 Valid Cross-site Scripting Low 2022-07-11 $900 22 Ability to potentially hit internal NGINX locations on *.myshopify.com by making use of the `X-Accel-Redirect` header via a configured App Proxy Analysed #1027873 Valid No weakness recorded None 2021-02-11 – 22 Order Creation Webhooks can be edited/deleted by STAFF with `Settings` only permission Analysed #431633 Valid Access Control Low 2019-05-11 $500 22 Information disclosure ( Google Sales Channel ) Analysed #1584718 Valid No weakness recorded – 2022-07-17 $500 21 Disconnecting an external login provider does not revoke session Analysed #1547684 Valid Authentication Medium 2022-12-01 $1,600 21 staffOrderNotificationSubscriptionDelete Could Be Used By Staff Member With Settings Permission Analysed #1102660 Valid Access Control Low 2022-02-09 – 21 staffOrderNotificationSubscriptionCreate Is Not Blocked Entirely From Staff Member With Settings Permission Analysed #1102652 Valid Access Control Low 2022-02-09 – 21 Ability to publish a paid theme without purchasing it. Analysed #927567 Valid Access Control Low 2020-08-27 $2,000 21 XSS / SELF XSS Analysed #906201 Valid Cross-site Scripting Low 2020-09-14 – 21 Password reset link not expired at Stocky App Analysed #898841 Valid Access Control – 2020-08-18 – 21 H1514 Stored XSS on Wholesale sales channel allows cross-organization data leakage Analysed #423454 Valid Cross-site Scripting Medium 2019-11-01 – 21 H1514 Stored XSS in Return Magic App portal content Analysed #420459 Valid Cross-site Scripting Medium 2019-11-08 – 21 XSS on manually entering Postal codes Analysed #190951 Valid Cross-site Scripting Medium 2016-12-17 $500 21 Bypassing HTML filter in "Packing Slip Template" Lead to SSRF to Internal Kubernetes Endpoints Analysed #1115139 Valid Server-Side Request Forgery Low 2021-12-02 – 20 Store Deletion or Sell without authentication Analysed #1087382 Valid Authentication Low 2021-10-21 – 20 Inject page in admin panel via Shopify.API.pushState [New Payload] Analysed #883867 Valid Cross-site Scripting Low 2020-12-27 $500 20 Unpublished Product Images can be disclosed Analysed #534554 Valid Access Control Low 2019-06-12 $500 20 Access to Private Photos of Apps in App section(IDOR) Analysed #318751 Valid Insecure Direct Object Reference Medium 2018-03-05 – 20 Unauthorized access to Zookeeper on http://locutus-zk3.ec2.shopify.com:2181 Analysed #154369 Valid Authentication – 2016-08-08 $1,000 20 https://windsor.shopify.com/ takeover Analysed #150374 Valid Open Redirect – 2016-07-18 – 20 HTTP-Response-Splitting on v.shopify.com Analysed #106427 Valid No weakness recorded – 2016-01-17 $500 20 Attacker is able to query Github repositories of arbitrary Shopify Hydrogen Users Analysed #1692788 Valid Access Control Low 2023-03-09 $900 19 Domain Takeover at 3hopify.media Analysed #1344982 Valid Access Control None 2021-10-21 – 19 Staff Member can Get POS Access Without User Interaction Analysed #1018094 Valid No weakness recorded Medium 2020-11-19 – 19 Open redirect allows changing iframe content in *.myshopify.com/admin/themes/<id>/editor Analysed #165046 Valid Open Redirect – 2016-09-22 – 19 Read access to hidden orders,products,customers etc. by limited access Staff member through reference page in Comments (Information disclosure ) Analysed #154405 Valid Authentication – 2018-12-06 – 19 Missing HMAC validation on /uninstall webhook in Shopify/sample-django-app reference template #3697491 Informative Cryptography None 2026-06-01 – 18 Self XSS in https://linkpop.com/dashboard/admin Analysed #1591403 Valid Cross-site Scripting Low 2022-10-13 – 18 Ability to add address without being an admin or staff in the store via wholesale store Analysed #1279322 Valid No weakness recorded Low 2021-12-03 $500 18 [h1-2102] Information disclosure - ShopifyPlus add user displays existing Shopify ID fullname Analysed #1083922 Valid Information Disclosure Medium 2022-02-10 – 18