Shopify · Report #1820953
Non-store owners can transfer Shopify-managed domain to another domain provider
Summary
Shopify merchants can purchase and manage domains through Shopify. As part of this service, shop owners can delegate the Transfer domain to another Shopify store permission to shop staff, which allows staff to transfer domains from one shop to another.
Staff members without the Transfer domain to another Shopify store permission were able to transfer the shops domain to another provider.
How it was found
According to docs here, only store owners can transfer domains to another domain provider. {F2100708}
This is not enforced as users/staff members without the Transfer domain to another Shopify store permission can perform this action as well as staff members that aren't a store owner in themselves.
Shops Used to Test:
███
Steps To Reproduce:
-
Login as a staff member with these permissions only: {F2100711}
-
From your Shopify admin, go to
Settings > Domains. -
In the Shopify-managed domains section, click the name of the domain that you want to transfer.
-
Click
Transfer domain > Transfer to another provider. -
Review the information, and then click
Confirm. The domain authorization code is displayed on your domain's information page. -
Give the domain authorization code to your new domain provider to verify the transfer.
-
Done.
Supporting Material:
███████
Impact
Shopify-managed domains can be transferred to another domain provider by a staff member without Transfer domain to another Shopify store permission and a non-store owner.