Shopify: Some store settings/data are accessible to "No Access" permission users on GraphQL LiveView operation
Summary GraphQL LiveView operation doesn't properly check for permissions before returning data. This allows "No Access" users to access some store settings and data by providing complete Shop schema fields in the request string. Steps to reproduce 1. Log into an attacker account of a test store...