Shopify · Report #56726
Invitation issue
Validstatus
3upvotes
16 Sept 2015disclosed
Summary
Only the the store owner is allowed to create new staff members, but staff members with full access can take over other invited staff members' accounts using the invitation link that was available in Settings -> Account page. To resolve this, we changed the display of the Account page so only the account owner has access to the invitation link.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.