The Shopify App Rails engine includes a token‑exchange authentication mechanism that, between releases 22.1.0 and 23.0.3, incorrectly accepts a shop identifier supplied in the request query string instead of the one trusted from a verified Shopify ID token or active session. This leads to a post‑authentication authorization bypass: an attacker who already holds a valid Shopify session token for one shop can supply a different shop value in that parameter and cause the application to treat the request as belonging to the other shop. The consequence is unauthorized access to shop‑scoped data or actions, and a potential theft of sensitive confidential data. The weakness corresponds to CWE‑863, an authorization bypass via user‑controlled privilege level.

Affected systems are Shopify’s shopify_app Ruby on Rails engine used by Shopify app developers. Versions from 22.1.0 up through 23.0.3 contain the vulnerability. Any application that relies on token‑exchange authentication, accepts a shop query parameter, and uses current_shopify_domain or params[:shop] for tenant lookup, authorization, or data access without additional checks is impacted. Updating to 23.0.3 or later removes the flaw.

The CVSS base score of 7.6 indicates a high severity, but the EPSS score is not available and it is not currently listed in the CISA KEV catalog. The vulnerability requires an attacker to possess a legitimate Shopify session token for one shop, after which the attacker can pivot to any other shop by manipulating the query parameter. Because the attack relies on a legitimate session, the attack surface is limited to accounts that have already authenticated, but the resulting privilege escalation allows significant cross‑shop data exposure. Therefore, the risk is high for any app exposed to the token‑exchange route that has not yet been patched.