Shopify · Report #99863
From full-access account to Account Owner
Validstatus
$500bounty
13upvotes
18 Sept 2018disclosed
Summary
@rms reported an issue where a full-access users could create restricted users, even though the UI didn't make it seem like this was intended. We updated the UI to make this clearer.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.