Password protection can be removed for newly created development store

Disclosed: 2020-09-14 18:59:32 By imgnotfound To shopify
Unknown
Vulnerability Details
## Details Per https://help.shopify.com/en/partners/dashboard/managing-stores/development-stores#the-development-store-password-page, it states that the password **can only be removed once the store has been transferred or switch to a paid plan**. ``` You can remove the password page only after you transfer the store to a merchant or switch the store to a paid plan. ``` However, it is still possible to remove the password by using the GraphQL **PreferencesSave** operation. ## Steps to reproduce 1. Create a development store using a partner account 2. From that shop admin, go to **Online Store > Preferences** 3. Make any change to the page and intercept the request 4. Update the `passwordProtection.enabled` property to `false` The store is now paswordless. ## Demo ████ ## Impact Disable development store password
Actions
View on HackerOne
Report Stats
  • Report ID: 965510
  • State: Closed
  • Substate: resolved
  • Upvotes: 10
Share this report