How it was found

Description

An administrator who lacks the 'Settings' permission is not able to see the shops payment gateways through the UI. But the endpoint shop.myshopify.com/admin/payment_gateways.json does disclose payment gateways to the unprivileged user.

Mitigation

Restrict the endpoint in question to be only accessible with the correct permission set.