# [h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilege

A low-privilege POS user could obtain a POS access token and query GraphQL to read all staff PINs, including the shop owner's, enabling privilege escalation at the terminal.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: ramsexy
- Disclosed: 2021-04-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1091303
- Library page: https://bugbountylibrary.com/r/h1%3A1091303
- Tags: area:web3 domain:web impact:pii-leak impact:privesc kind:bounty platform:hackerone sev:medium tech:graphql technique:source-review vuln:access-control vuln:info-disclosure vuln:privilege-escalation

**Target:** Shopify Admin GraphQL staffMembers endpoint / POS xauth token
**Root cause:** The POS access token issued to a low-privilege staff member carried scopes sufficient to query the staffMembers GraphQL field, which returned the `pin` field for all staff including the shop owner, without per-field authorization.
**Steps:**
1. Install Shopify POS app; create a user with minimal privileges and grant POS access with Associate role.
2. Remove all admin permissions from the user but keep POS access.
3. POST /admin/api/xauth with `{"api_key":"<pos api_key>","login":"<user>","password":"<pass>"}` to obtain a POS `access_token`.
4. POST /admin/api/unversioned/graphql with header `X-Shopify-Access-Token: <token>` and query `shop { staffMembers { edges { node { ... on StaffMember { pin email name } } } } }`.
5. Read `pin` values for all staff, including the shop owner's PIN.
**How found:** Researcher noticed the POS token's scope list included broad read scopes despite the user having no admin permissions, then queried the staffMembers GraphQL schema and observed the `pin` field returned in the response.
**Exploitation:** Attacker with a low-privilege POS account authenticates via xauth to get a POS token, queries GraphQL staffMembers to harvest the manager/owner PIN, then uses that PIN at a physical POS terminal to unlock elevated actions.
**Escalation:** Chained leaked manager PIN with physical access to a POS terminal to perform actions beyond the low-privilege role.
**Insight:** When a token's scope string is broader than the user's UI permissions, enumerate the GraphQL schema for sensitive scalar fields (pin, secret, token) on objects the token can reach; POS/mobile tokens often carry legacy broad scopes.