Takeover an account that doesn't have a Shopify ID and more Analysed #867513 Valid No weakness recorded – 2020-09-02 – 3,006 Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSO Analysed #791775 Valid No weakness recorded – 2020-04-01 – 1,922 Github access token exposure Analysed #1087489 Valid No weakness recorded – 2021-07-26 $50,000 1,601 [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation Analysed #796808 Valid No weakness recorded – 2020-04-01 – 894 H1514 Remote Code Execution on kitcrm using bulk customer update of Priority Products Analysed #422944 Valid Command and Code Injection – 2020-02-06 – 830 SSRF in Exchange leads to ROOT access in all instances #341876 Valid Server-Side Request Forgery – 2018-05-23 – 587 Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalation Analysed #910300 Valid Access Control – 2020-09-15 – 559 Shopify Stocky App OAuth Misconfiguration Analysed #740989 Valid Access Control – 2019-12-11 – 527 H1514 Server Side Template Injection in Return Magic email templates? Analysed #423541 Valid Command and Code Injection – 2019-04-04 – 409 H1514 Ability to MiTM Shopify PoS Session to Takeover Communications Analysed #423467 Valid Input Validation and Logic – 2019-11-04 – 372 XSS while logging using Google Analysed #691611 Valid Cross-site Scripting – 2019-09-11 $1,750 341 Stored XSS in my staff name fired in another your internal panel Analysed #946053 Valid Cross-site Scripting – 2020-07-29 – 326 Shopify admin authentication bypass using partners.shopify.com Analysed #270981 Valid Access Control – 2017-09-28 – 311 Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation Analysed #796956 Valid No weakness recorded – 2020-04-01 – 310 CSRF on connecting Paypal as Payment Provider Analysed #807924 Valid Cross-Site Request Forgery – 2020-04-10 – 304 Ability to bypass partner email confirmation to take over any store given an employee email Analysed #300305 Valid Race Conditions – 2018-02-07 $15,250 273 DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.com Analysed #1695604 Valid Other weaknesses Medium 2025-06-04 $3,800 266 Shopify Partners Invitation Process Allows Privilege Escalation Without Email Verification Analysed #2885269 Valid Access Control Medium 2025-05-15 – 245 XSS at jamfpro.shopifycloud.com Analysed #1444682 Valid Cross-site Scripting Medium 2023-02-02 $9,400 240 H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie Stuffing Analysed #422043 Valid Cross-site Scripting – 2019-04-17 – 195 H1514 [*.(my)shopify.com] - Viewing Password Protected Content Analysed #421859 Valid Authentication – 2019-05-22 $3,000 192 IDOR on GraphQL queries BillingDocumentDownload and BillDetails Analysed #2207248 Valid Insecure Direct Object Reference Medium 2024-02-08 $5,000 187 Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.com Analysed #1457471 Valid Access Control Medium 2025-03-20 – 181 XSS at https://exchangemarketplace.com/blogsearch Analysed #1145162 Valid Cross-site Scripting – 2021-04-09 – 174 GraphQL AdminGenerateSessionPayload is leaked to staff with no permission Analysed #898528 Valid No weakness recorded – 2020-07-16 – 173 [h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034) Analysed #1086108 Valid Access Control – 2021-03-25 $3,100 166 XSS in www.shopify.com/markets?utm_source= Analysed #1699762 Valid Cross-site Scripting Low 2022-10-18 – 159 Undocumented `fileCopy` GraphQL API Analysed #981472 Valid Access Control – 2020-10-22 $2,000 157 Session works after logout from Shopify account and password of online store is displayed Analysed #837729 Valid No weakness recorded – 2020-04-27 – 157 Stored XSS in SVG file as data: url Analysed #1276742 Valid Cross-site Scripting Medium 2023-01-31 $5,300 153 Informations disclosure - Access to some checkout informations Analysed #1064869 Valid No weakness recorded – 2021-03-13 – 150 User with removed manage shops permissions is still able to make changes to a shop Analysed #273099 Valid Access Control – 2020-06-12 – 145 H1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.com Analysed #423136 Valid Authentication – 2019-04-25 – 144 HTTP Response Header Injection in shopify/pitchfork + Rack 3 Analysed #2279572 Valid Injection and Smuggling Low 2025-03-27 $800 136 [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image Analysed #1021906 Valid Information Disclosure – 2020-11-21 $2,900 135 Create free Shopify application credits. Analysed #1257428 Valid Access Control Medium 2021-09-10 – 134 Reflected XSS In Marketing Reports Page On *.myshopify.com/admin Analysed #1754843 Valid Cross-site Scripting Medium 2025-04-15 – 128 XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog" Analysed #231053 Valid Cross-site Scripting – 2017-05-30 $3,000 121 Disclose Any Store products, Files, Purchase Orders Via Email through Shopify Stocky APP Analysed #763994 Valid Access Control – 2020-02-02 – 116 Account Takeover Vulnerability in Shopify Collabs Platform Due to Missing Email Verification Analysed #1679734 Valid No weakness recorded Low 2025-03-11 $800 112 Reflected XSS on help.shopify.com Analysed #1940245 Valid Cross-site Scripting Low 2024-01-25 $500 111 Access to Employee calendar disclosing internal presentation and meetings Analysed #489284 Valid Access Control – 2019-03-08 $1,000 111 Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering Analysed #2509022 Valid Cross-site Scripting Medium 2026-06-18 $1,600 110 Admin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.php Analysed #1417288 Valid Access Control Medium 2022-08-11 $2,900 109 Stored XSS in Shopify Chat Analysed #756729 Valid Cross-site Scripting – 2019-12-23 $500 106 Reflected XSS in *.myshopify.com/account/register Analysed #470206 Valid Cross-site Scripting – 2019-03-12 – 104 Bypass a fix for report #708013 Analysed #1363672 Valid Authentication Medium 2021-12-07 $3,500 102 Exposed Cortex API at https://cortex-ingest.shopifycloud.com/ Analysed #1258871 Valid Misconfiguration and Insecure Design Medium 2022-12-02 $6,300 101 Reflected XSS online-store-git.shopifycloud.com Analysed #1410459 Valid Cross-site Scripting Medium 2022-01-20 $3,500 98 Ability to publish a paid theme without purchasing it. #953083 Valid Access Control – 2020-08-27 $2,000 90