PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How a Privilege Escalation Led to Unrestricted Admin Account Creation in Shopify

hackerone.com | vulnerability | #bug-bounty | #access-control | #privilege-escalation | #authentication | #hackerone | #shopify
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A HackerOne write-up details a Shopify privilege escalation bug enabling unrestricted admin account creation, and how layered access controls can be bypassed.
Published
Collected

Related coverage

research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
vulnerability · hackerone.com
Shopify Thanks Over 300 Hackers, Pays $850,000+ to Hackers in Three Years
Shopify marks three years of its bug bounty program: $850,000+ paid to over 300 hackers, 759 vulnerabilities resolved, and a 3-hour average first response time.
vulnerability · blog.quarkslab.com
MyReport Updater: From gRPC to SYSTEM
MyReport is a report generation software often used as a component of web-based applications. We describe a privilege escalation and remote code execution vulnerabilities in MyReport Updater 2.1.1 through its update configuration and gRPC service.
vulnerability · blog.quarkslab.com
Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739)
Local privilege escalation in the Cato VPN Client through the split-tunnel upload flow, from named pipe to SYSTEM delete and Windows Installer rollback.
vulnerability · projectdiscovery.io
Introducing Neo Triage
On October 26, 2026 we're releasing Neo Triage, an autonomous engine for vulnerability triage. While other tools rank your backlog, Neo clears it.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
Back