CVE-2026-63414 with a CVSS score of 7.6 is a cross-shop authorization bypass in the shopify_app Ruby gem’s token-exchange authenticated controllers. The flaw occurs when current_shopify_domain resolves to the sanitized shop query parameter instead of the shop identity derived from the verified token or active session. An attacker with a valid session token for one shop can send an authenticated request containing a different shop query parameter. If the application uses current_shopify_domain or the request shop parameter for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped resource access, the application may incorrectly treat the requested shop as the authenticated shop. This allows requests to operate in the context of another shop, potentially exposing its application data or enabling unauthorized shop-scoped actions, compromising confidentiality, integrity, and tenant isolation in multi-shop deployments.
We recommend you to update shopify_app to version 23.0.3 or later.[/subscribe_to_unlock_form]
CVE-2026-63414 with a CVSS score of 7.6 is a cross-shop authorization bypass in the shopify_app Ruby gem’s token-exchange authenticated controllers. The flaw occurs when current_shopify_domain resolves to the sanitized shop query parameter instead of the shop identity derived from the verified token or active session. An attacker with a valid session token for one shop can send an authenticated request containing a different shop query parameter. If the application uses current_shopify_domain or the request shop parameter for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped resource access, the application may incorrectly treat the requested shop as the authenticated shop. This allows requests to operate in the context of another shop, potentially exposing its application data or enabling unauthorized shop-scoped actions, compromising confidentiality, integrity, and tenant isolation in multi-shop deployments.
We recommend you to update shopify_app to version 23.0.3 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]