Accessing Payments page and adding payment methods with limited access accounts

Summary

Users with the Orders permission were allowed to see the store's payment gateway information. This page should have been restricted to users with the Settings permission only.

Using this vulnerability a User with limited access/ No access to Settings could add/alter/change Payment settings while having disallowed by the Administrator.

It was possible to use this Authorization bypass to add payment data without administrator notice. Shopify resolved this issue by applying the authorization check on that function