Able to Login deactivated staff account in shopify app mobile
Unknown
Vulnerability Details
Hi Shopify,
Deactivated staff account is able to login in shopify mobile app.
__STEPS__
1. Login your owner account
2. Go to Staff Accounts and deactivate your staff account
3. Login to your staff account in your shopify mobile app
__As you can see you were able to login even the staff account was deactivated by the account owner__
Actions
View on HackerOneReport Stats
- Report ID: 175490
- State: Closed
- Substate: resolved
- Upvotes: 47