Shopify: Invitation issue

2015-04-16T17:36:16
ID H1:56726
Type hackerone
Reporter frozen
Modified 2015-09-16T20:35:43

Description

Only the the store owner is allowed to create new staff members, but staff members with full access can take over other invited staff members' accounts using the invitation link that was available in Settings -> Account page. To resolve this, we changed the display of the Account page so only the account owner has access to the invitation link.