Shopify · Report #93616
get users information without full access
Validstatus
$500bounty
5upvotes
4 Nov 2015disclosed
Summary
An issue where some sensitive information about a store's staff member could be returned to any other staff member. For instance, the last IP address of the store owner could be retrieved by any other staff member of the store, which is undesirable.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.