Shopify: staffOrderNotificationSubscriptionCreate Is Not Blocked Entirely From Staff Member With Settings Permission

Hi, I found that the GraphQL call staffOrderNotificationSubscriptionCreate is not blocked from the staff member with Settings permission Steps to reproduce - Login as a staff member with Settings permission - Make this GraphQL call to...

Shopify: [h1-2102] [PLUS] User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only

Summary: PLUS User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only Description: User with Store management permission as shown in below screenshot F1168574 Should not have the ability to enforce SAML organization...

HackerOne: Unauthorized access to metadata of undisclosed reports that were retested

Summary: reportretests object in User node discloses some information about undisclosed report Description: An attacker can get some infomation such as "assetname" , "assettype" , "severityrating" , "weaknessname" of undisclosed report Steps To Reproduce 1. Invoke the below graphql call POST...