CVE-2026-63414
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.
Fixes and workarounds
Fix
shopify_app (rubygems): GitHub reports patched versions 23.0.3. Check the advisory for the affected release branch.
Source: GitHub GHSA-6j52-38f8-qhxrFix
shopify_app (RubyGems): OSV reports a fixed version 23.0.3. Check the advisory for supported release branches.
Source: OSV GHSA-6j52-38f8-qhxrAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| shopify_app Shopify |
>= 22.1.0, < 23.0.3 (affected) | CNA: GitHub_M |
shopify_appshopify_app
rubygems |
>= 22.1.0, < 23.0.3 (affected, GitHub advisory range) | GitHub GHSA-6j52-38f8-qhxr |
shopify_appshopify_app
RubyGems |
22.1.0 (affected, RubyGems) 22.2.0 (affected, RubyGems) 22.2.1 (affected, RubyGems) 22.3.0 (affected, RubyGems) 22.3.1 (affected, RubyGems) 22.4.0 (affected, RubyGems) 22.5.0 (affected, RubyGems) 22.5.1 (affected, RubyGems) 22.5.2 (affected, RubyGems) 23.0.0 (affected, RubyGems) 23.0.1 (affected, RubyGems) 23.0.2 (affected, RubyGems) Ecosystem version events: introduced 22.1.0; fixed 23.0.3 Source events (ECOSYSTEM)Other versions: unaffected |
OSV GHSA-6j52-38f8-qhxr |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 7.6 high |
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | CNA: GitHub_M |
| 4.0 / 7.6 high |
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD: [email protected] |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxrCNA: GitHub_M · x_refsource_CONFIRM
- https://github.com/Shopify/shopify_app/pull/2081CNA: GitHub_M · x_refsource_MISC
- https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756CNA: GitHub_M · x_refsource_MISC
- https://github.com/Shopify/shopify_app/releases/tag/v23.0.3CNA: GitHub_M · x_refsource_MISC
- https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756[email protected]
- https://github.com/Shopify/shopify_app/pull/2081[email protected]
- https://github.com/Shopify/shopify_app/releases/tag/v23.0.3[email protected]
- https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr[email protected]
- https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxrGitHub Security Advisories · advisory
- https://github.com/advisories/GHSA-6j52-38f8-qhxrOSV / GitHub Security Advisories · advisory
- https://osv.dev/vulnerability/GHSA-6j52-38f8-qhxrOSV / GitHub Security Advisories · osv
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.