Shopify: get users information without full access

ID H1:93616
Type hackerone
Reporter supernatural
Modified 2015-11-04T18:50:22


An issue where some sensitive information about a store's staff member could be returned to any other staff member. For instance, the last IP address of the store owner could be retrieved by any other staff member of the store, which is undesirable.