HexBrain

Shopify · Report #56726

Invitation issue

Validstatus
3upvotes
16 Sept 2015disclosed

Summary

Only the the store owner is allowed to create new staff members, but staff members with full access can take over other invited staff members' accounts using the invitation link that was available in Settings -> Account page. To resolve this, we changed the display of the Account page so only the account owner has access to the invitation link.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original