# Staff with no permissions can listen to Shopify Ping conversations by registering to its different WebSocket Events

A permissionless staff account could subscribe to Shopify Ping WebSocket events and eavesdrop on live customer chat conversations and order details.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: imgnotfound
- Disclosed: 2020-11-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1023669
- Library page: https://bugbountylibrary.com/r/h1%3A1023669
- Tags: area:web3 domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium tech:graphql tech:websocket technique:recon vuln:access-control vuln:info-disclosure

**Target:** GraphQL WebSocket endpoint wss://argus.shopifycloud.com/graphql
**Root cause:** The argus WebSocket GraphQL EventSubscription resolver did not enforce staff permissions on eventName subscriptions, so any authenticated staff token could subscribe to conversation/message/participant events for the shop.
**Steps:**
1. Log in as staff with no permissions at `https://{shop}.myshopify.com/admin`
2. Capture argus token from GetToken response at `https://{shop}.myshopify.com/admin/internal/web/graphql/core`
3. Connect: `websocat "wss://argus.shopifycloud.com/graphql?shop_id={id}"`
4. Send `{"type":"connection_init","payload":{"Authorization":"{token}"}}`
5. Send `start` frames with `EventSubscription` query for eventName `conversation`, `message_status`, `message`, `participant`, `read_state`
6. Trigger a chat via `https://{shop}.myshopify.com/?chat` in incognito and observe incoming events with customer/order data
**How found:** Noticed the argus WebSocket endpoint and its EventSubscription operation, then tested whether a zero-permission staff token could still register for conversation-related event names.
**Exploitation:** Any authenticated staff token, regardless of role permissions, subscribes to shop-scoped event streams and passively receives live customer chat messages and order status links as they occur.
**Insight:** Internal GraphQL subscription endpoints often authorize the connection but not each eventName; enumerate event names and test with a least-privileged account to see if subscription-level authz is missing.