Shopify: Information disclosure ( Google Sales Channel )

In the review on apps.shopify.com the Google sales channel has a review of 5407 but the actual number of shopify stores that use the Google channel I believe is more than that number so I think this vulnerability can have an impact on many shopify stores and here I found a vulnerability where attackers can exploit every shopify store that has a Google Sales channel even though the store is in Password protection Install google channel at your-store.myshopify.com Enable password protection at your-store.myshopify.com Add new product in shopify store Now go to this link : google-shopping.shopifycloud.com/shopify/products?shop=your-store.myshopify.com&id=PRODUCT ID&locale=en Change PRODUCT ID with your shopify product id Now in the response you will see information disclosure in the form of data-channel-id and data-user-email data-channel-id="70715703461" data-user-email="[email protected]" Even though the shopify store which is in a password protected state is very private, but in this vulnerability the attacker can still find out sensitive information from the shopify store which is in a password protected state. Stores that do not have a password protected are easier to exploit because attackers can get the product id of the victim's store Impact Vulnerabilities that allow attackers to get sensitive information from victim...