Shopify: race condition in adding team members

ID H1:176127
Type hackerone
Reporter flashdisk
Modified 2016-11-10T17:52:19


The researcher reported a race condition when adding new staff members that would allow bypassing the staff account limit for all plans. We fixed this issue by adding an exclusive lock around the account creation process.