HexBrain
Open on HackerOneSign in

Shopify · Report #175490

Able to Login deactivated staff account in shopify app mobile

Validstatus
48upvotes
29 Nov 2016disclosed

Summary

Authentication Bypass occured to <any-store>.shopify.com for Deactivated Staff Acounts in Mobile Application

How it was found

Hi Shopify,

Deactivated staff account is able to login in shopify mobile app.

STEPS

  1. Login your owner account
  2. Go to Staff Accounts and deactivate your staff account
  3. Login to your staff account in your shopify mobile app

As you can see you were able to login even the staff account was deactivated by the account owner

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original