Zero Radar
← feed
HighVulnerabilityCVE-2026-63414updated 30 Oct 2026, 23:20 UTC

Shopify App gem can mix up which shop a request belongs to

A request signed in for one Shopify store could carry a different store's name in its address, and the app might treat it as the wrong store. That could expose another store's data.

Fixed in shopify_app 23.0.3Official, 2 sources
SeverityHighCVSS 7.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesshopify_app 23.0.3 · since 29 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker with one shop's tokenHolds a valid session for Shop A
  2. 2Crafted requestAdds shop=ShopB in the query
  3. 3Context resolved wronglycurrent_shopify_domain uses the shop parameter
  4. 4Wrong shop's dataApp scopes queries to Shop B
  5. ResultAttacker reads or changes another shop's data

What happened

In shopify_app token-exchange authenticated controllers, current_shopify_domain can resolve to the sanitized shop query parameter instead of the shop from the verified ID token or session, enabling cross-shop context confusion.

Why it is dangerous: An attacker with a valid Shopify session token for one shop could access or act on another shop's data if the app uses current_shopify_domain or params[:shop] for authorization or data lookup.

Are you affected?

You are affected if your app uses shopify_app 22.1.0 up to (not including) 23.0.3 with token-exchange authentication and relies on current_shopify_domain or params[:shop] for shop-scoped access.

Package / productAffected versionsFixed in
shopify_app · rubygems>= 22.1.0, < 23.0.323.0.3

What to do

  1. Upgrade shopify_app to version 23.0.3 or later
  2. Until upgraded, stop using params[:shop] or current_shopify_domain for authorization, tenant lookup or data scoping; use current_shopify_session.shop or the verified JWT dest value instead
  3. If you keep a shop parameter, reject requests with 401 Unauthorized when it does not match the authenticated shop

Timeline

  1. 29 Oct 2026, 16:39 UTC
    Publicly disclosed
  2. 29 Oct 2026, 16:39 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 29 Oct 2026, 16:40 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 23:20 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-63414 · GHSA-6j52-38f8-qhxr
CVSS
7.6 / 10
Disclosed
29 Oct 2026, 16:39 UTC
On Zero Radar
29 Oct 2026, 16:40 UTC (1 min after disclosure)
Last change
30 Oct 2026, 23:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Shopify App gem can mix up which shop a request belongs to · Zero Radar