# Informations disclosure - Access to some checkout informations

GraphQL CheckoutStatus query on Shop app server allowed enumerating sequential checkout IDs to leak checkout secrets, tokens and shipping addresses.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: imgnotfound
- Disclosed: 2021-03-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1064869
- Library page: https://bugbountylibrary.com/r/h1%3A1064869
- Tags: area:web3 domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium tech:graphql technique:recon vuln:access-control vuln:idor vuln:info-disclosure

**Target:** GraphQL endpoint arrive-server.shopifycloud.com CheckoutStatus query
**Root cause:** checkoutStatus(id) resolver did not verify the requesting user owned the checkout, and IDs were sequential integers, enabling enumeration.
**Steps:**
1. POST /graphql to arrive-server.shopifycloud.com with `mutation SignInAsGuest` to obtain an accessToken
2. Send `query CheckoutStatus($id: ID!)` with `Authorization: Bearer {accessToken}` and variables `{"id":"48805"}`
3. Iterate id from 1 to 48908 to enumerate other users' checkouts
4. Read payJsonParams containing checkout_secret, token, shopify_domain and checkout_token
**How found:** Researcher noticed CheckoutStatus accepted an integer ID and probed sequential values, observing valid responses for IDs 1 through 48908 while new IDs returned nothing.
**Exploitation:** Attacker authenticates as guest, then iterates sequential checkout IDs; returned payJsonParams exposes checkout_secret and token, allowing access to the checkout page and buyer email/shipping data.
**Insight:** Guest-auth GraphQL mutations that mint tokens can unlock sibling queries; probe ID-typed arguments with sequential integers to test for missing ownership checks on resolvers.