Privilege Escalation - A `MEMBER` with no ACCESS to `ORDERS` can still access the orders by using `Order Printer APP`

Summary

This researcher pointed out that Shopify's app ecosystem has no built-in way of verifying who is using an app, and therefore most apps do not verify user privileges when requesting and displaying a store's data. To resolve this issue we implemented an "online access" mode in which an app can request temporary access tied to an individual user account. API requests in this mode may fail depending on the privileges that were granted to the user.

Note: We are in the process of upgrading our apps to use the online access mode, but not all apps have been converted yet. Reports pertaining to other apps that fail to verify user privileges will be closed as duplicates.

A complete explanation of online and offline API access modes can be found here: https://help.shopify.com/api/getting-started/authentication/oauth#api-access-modes