Shopify · Report #860197

A staff without export customers permissions can still export customers CSV file

Validstatus

9upvotes

15 Sept 2020disclosed

How it was found

Steps To Reproduce:

Login as staff without export customers permissions but with customers permissions.
Go to customers pages, you can still export customers CSV file.

{F805311} {F805312} {F805313}

A staff without export customers permissions can still export customers CSV file.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original