Shopify: Low Privileged user can add or remove cash to/from sales register

Low privileged user having no access to Shopify POS and very low permission set is not allowed to add cash to the sales register or remove cash from the sales register. But missing server-side permission checks on the vulnerable request allows a low privileged user to do this. A low privileged ca...