shopify_app
This gem is used to get quickly started with the Shopify API
View on Github
Activity
- Latest release
- 4mo ago
- Total releases
- 198
- Cadence
- ~24 days
- Last 12 months
- 4
Reach
- Stars
- —
Details
- First release
- Feb 26, 2011
| Version | Released | |
|---|---|---|
23.0.3
patch
| ||
23.0.2
patch
1 CVE
CVE-2026-63414
GHSA-6j52-38f8-qhxr
Oct 29, 2026
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
High
Network
Low
Low
None
In token-exchange authenticated controllers, As a result, a request authenticated for one shop could include a different Applications that used The patched version hardens token-exchange handling so that:
ImpactIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different Affected applications are those that:
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. RemediationUpgrade to WorkaroundsApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
CreditThis issue was responsibly reported by Hackerone researcher leqtuer. Affected versions
22.1.0
22.2.0
22.2.1
22.3.0
22.3.1
22.4.0
22.5.0
22.5.1
22.5.2
23.0.0
23.0.1
23.0.2
Fixed in
23.0.3
References Updated Oct 29, 2026 · Source: OSV.dev | ||
23.0.1
patch
1 CVE
CVE-2026-63414
GHSA-6j52-38f8-qhxr
Oct 29, 2026
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
High
Network
Low
Low
None
In token-exchange authenticated controllers, As a result, a request authenticated for one shop could include a different Applications that used The patched version hardens token-exchange handling so that:
ImpactIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different Affected applications are those that:
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. RemediationUpgrade to WorkaroundsApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
CreditThis issue was responsibly reported by Hackerone researcher leqtuer. Affected versions
22.1.0
22.2.0
22.2.1
22.3.0
22.3.1
22.4.0
22.5.0
22.5.1
22.5.2
23.0.0
23.0.1
23.0.2
Fixed in
23.0.3
References Updated Oct 29, 2026 · Source: OSV.dev | ||
23.0.0
major
1 CVE
CVE-2026-63414
GHSA-6j52-38f8-qhxr
Oct 29, 2026
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
High
Network
Low
Low
None
In token-exchange authenticated controllers, As a result, a request authenticated for one shop could include a different Applications that used The patched version hardens token-exchange handling so that:
ImpactIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different Affected applications are those that:
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. RemediationUpgrade to WorkaroundsApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
CreditThis issue was responsibly reported by Hackerone researcher leqtuer. Affected versions
22.1.0
22.2.0
22.2.1
22.3.0
22.3.1
22.4.0
22.5.0
22.5.1
22.5.2
23.0.0
23.0.1
23.0.2
Fixed in
23.0.3
References Updated Oct 29, 2026 · Source: OSV.dev | ||
22.5.2
patch
1 CVE
CVE-2026-63414
GHSA-6j52-38f8-qhxr
Oct 29, 2026
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
High
Network
Low
Low
None
In token-exchange authenticated controllers, As a result, a request authenticated for one shop could include a different Applications that used The patched version hardens token-exchange handling so that:
ImpactIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different Affected applications are those that:
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. RemediationUpgrade to WorkaroundsApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
CreditThis issue was responsibly reported by Hackerone researcher leqtuer. Affected versions
22.1.0
22.2.0
22.2.1
22.3.0
22.3.1
22.4.0
22.5.0
22.5.1
22.5.2
23.0.0
23.0.1
23.0.2
Fixed in
23.0.3
References Updated Oct 29, 2026 · Source: OSV.dev | ||
22.5.1
patch
1 CVE
CVE-2026-63414
GHSA-6j52-38f8-qhxr
Oct 29, 2026
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
High
Network
Low
Low
None
In token-exchange authenticated controllers, As a result, a request authenticated for one shop could include a different Applications that used The patched version hardens token-exchange handling so that:
ImpactIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different Affected applications are those that:
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. RemediationUpgrade to WorkaroundsApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
CreditThis issue was responsibly reported by Hackerone researcher leqtuer. Affected versions
22.1.0
22.2.0
22.2.1
22.3.0
22.3.1
22.4.0
22.5.0
22.5.1
22.5.2
23.0.0
23.0.1
23.0.2
Fixed in
23.0.3
References Updated Oct 29, 2026 · Source: OSV.dev | ||
22.5.0
minor
1 CVE
CVE-2026-63414
GHSA-6j52-38f8-qhxr
Oct 29, 2026
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
High
Network
Low
Low
None
In token-exchange authenticated controllers, As a result, a request authenticated for one shop could include a different Applications that used The patched version hardens token-exchange handling so that:
ImpactIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different Affected applications are those that:
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. RemediationUpgrade to WorkaroundsApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
CreditThis issue was responsibly reported by Hackerone researcher leqtuer. Affected versions
22.1.0
22.2.0
22.2.1
22.3.0
22.3.1
22.4.0
22.5.0
22.5.1
22.5.2
23.0.0
23.0.1
23.0.2
Fixed in
23.0.3
References Updated Oct 29, 2026 · Source: OSV.dev | ||
22.4.0
minor
1 CVE
CVE-2026-63414
GHSA-6j52-38f8-qhxr
Oct 29, 2026
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
High
Network
Low
Low
None
In token-exchange authenticated controllers, As a result, a request authenticated for one shop could include a different Applications that used The patched version hardens token-exchange handling so that:
ImpactIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different Affected applications are those that:
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. RemediationUpgrade to WorkaroundsApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
CreditThis issue was responsibly reported by Hackerone researcher leqtuer. Affected versions
22.1.0
22.2.0
22.2.1
22.3.0
22.3.1
22.4.0
22.5.0
22.5.1
22.5.2
23.0.0
23.0.1
23.0.2
Fixed in
23.0.3
References Updated Oct 29, 2026 · Source: OSV.dev | ||
22.3.1
patch
1 CVE
CVE-2026-63414
GHSA-6j52-38f8-qhxr
Oct 29, 2026
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
High
Network
Low
Low
None
In token-exchange authenticated controllers, As a result, a request authenticated for one shop could include a different Applications that used The patched version hardens token-exchange handling so that:
ImpactIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different Affected applications are those that:
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. RemediationUpgrade to WorkaroundsApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
CreditThis issue was responsibly reported by Hackerone researcher leqtuer. Affected versions
22.1.0
22.2.0
22.2.1
22.3.0
22.3.1
22.4.0
22.5.0
22.5.1
22.5.2
23.0.0
23.0.1
23.0.2
Fixed in
23.0.3
References Updated Oct 29, 2026 · Source: OSV.dev | ||
22.3.0
minor
1 CVE
CVE-2026-63414
GHSA-6j52-38f8-qhxr
Oct 29, 2026
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
High
Network
Low
Low
None
In token-exchange authenticated controllers, As a result, a request authenticated for one shop could include a different Applications that used The patched version hardens token-exchange handling so that:
ImpactIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different Affected applications are those that:
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. RemediationUpgrade to WorkaroundsApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
CreditThis issue was responsibly reported by Hackerone researcher leqtuer. Affected versions
22.1.0
22.2.0
22.2.1
22.3.0
22.3.1
22.4.0
22.5.0
22.5.1
22.5.2
23.0.0
23.0.1
23.0.2
Fixed in
23.0.3
References Updated Oct 29, 2026 · Source: OSV.dev | ||
22.2.1
patch
1 CVE
CVE-2026-63414
GHSA-6j52-38f8-qhxr
Oct 29, 2026
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
High
Network
Low
Low
None
In token-exchange authenticated controllers, As a result, a request authenticated for one shop could include a different Applications that used The patched version hardens token-exchange handling so that:
ImpactIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different Affected applications are those that:
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. RemediationUpgrade to WorkaroundsApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
CreditThis issue was responsibly reported by Hackerone researcher leqtuer. Affected versions
22.1.0
22.2.0
22.2.1
22.3.0
22.3.1
22.4.0
22.5.0
22.5.1
22.5.2
23.0.0
23.0.1
23.0.2
Fixed in
23.0.3
References Updated Oct 29, 2026 · Source: OSV.dev | ||
22.2.0
minor
1 CVE
CVE-2026-63414
GHSA-6j52-38f8-qhxr
Oct 29, 2026
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
High
Network
Low
Low
None
In token-exchange authenticated controllers, As a result, a request authenticated for one shop could include a different Applications that used The patched version hardens token-exchange handling so that:
ImpactIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different Affected applications are those that:
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. RemediationUpgrade to WorkaroundsApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
CreditThis issue was responsibly reported by Hackerone researcher leqtuer. Affected versions
22.1.0
22.2.0
22.2.1
22.3.0
22.3.1
22.4.0
22.5.0
22.5.1
22.5.2
23.0.0
23.0.1
23.0.2
Fixed in
23.0.3
References Updated Oct 29, 2026 · Source: OSV.dev | ||
22.1.0
minor
1 CVE
CVE-2026-63414
GHSA-6j52-38f8-qhxr
Oct 29, 2026
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
High
Network
Low
Low
None
In token-exchange authenticated controllers, As a result, a request authenticated for one shop could include a different Applications that used The patched version hardens token-exchange handling so that:
ImpactIn affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different Affected applications are those that:
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions. RemediationUpgrade to WorkaroundsApplications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
CreditThis issue was responsibly reported by Hackerone researcher leqtuer. Affected versions
22.1.0
22.2.0
22.2.1
22.3.0
22.3.1
22.4.0
22.5.0
22.5.1
22.5.2
23.0.0
23.0.1
23.0.2
Fixed in
23.0.3
References Updated Oct 29, 2026 · Source: OSV.dev | ||
22.0.1
patch
| ||
22.00.0
major
| ||
21.10.0
minor
| ||
21.9.0
minor
| ||
21.8.1
patch
| ||
21.8.0
minor
| ||
21.7.0
minor
| ||
21.6.0
minor
| ||
21.5.0
minor
| ||
21.4.1
patch
| ||
21.4.0
minor
| ||
21.3.1
patch
| ||
21.3.0
minor
| ||
21.2.0
minor
| ||
21.1.1
patch
| ||
21.1.0
minor
| ||
21.0.0
major
| ||
20.2.0
minor
| ||
20.1.1
patch
| ||
20.1.0
minor
| ||
20.0.2
patch
| ||
20.0.1
patch
| ||
20.0.0
major
| ||
19.1.0
minor
| ||
18.1.3
patch
|
18.1.3
patch
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
19.0.2
patch
| ||
19.0.1
patch
| ||
19.0.0
major
| ||
18.1.2
patch
|
18.1.2
patch
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
18.1.1
patch
|
18.1.1
patch
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
18.1.0
minor
|
18.1.0
minor
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
18.0.4
patch
|
18.0.4
patch
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
18.0.3
patch
|
18.0.3
patch
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
18.0.2
patch
|
18.0.2
patch
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
18.0.1
patch
|
18.0.1
patch
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
18.0.0
major
|
18.0.0
major
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
17.2.1
patch
|
17.2.1
patch
Dependencies (16)
+ 8 more
Changelog
Compare changes
|