Shopify: race condition in adding team members

2016-10-16T10:06:32
ID H1:176127
Type hackerone
Reporter flashdisk
Modified 2016-11-10T17:52:19

Description

The researcher reported a race condition when adding new staff members that would allow bypassing the staff account limit for all plans. We fixed this issue by adding an exclusive lock around the account creation process.