# Add new development stores without permission

Shopify Partners staff lacking development-store permission could still mint dev stores via the signup_object token endpoint and auto-login.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: jmp_35p
- Disclosed: 2021-06-04
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1167453
- Library page: https://bugbountylibrary.com/r/h1%3A1167453
- Tags: area:web domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium technique:source-review vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** partners.shopify.com partner dashboard / app.shopify.com signup service
**Root cause:** The /organizationID/stores/signup_object/dev_store endpoint returns a signup token based only on generic store access, without checking the specific development-store permission.
**Steps:**
1. Owner grants staff member dev-store + managed-store permission, then revokes dev-store permission leaving only managed-store add/remove.
2. Staff member sends `GET /organizationID/stores/signup_object/dev_store` and receives a signup token.
3. POST the token to `https://app.shopify.com/services/signup/create` with `signup_source=development+shop` and `signup[extra][organization_id]=<orgID>` plus shop name/email/password fields.
4. Development store is created and staff member is auto-logged in.
**How found:** Researcher noticed the signup_object endpoint returned a token as long as the staff member had any store access, then tested creating a dev store after the specific permission was revoked.
**Exploitation:** A low-privileged staff member obtains a signup token from the dev_store signup_object endpoint and submits it to the signup service to create and log into a development store, bypassing the revoked permission.
**Insight:** When permissions are revoked, test token-minting endpoints that gate on a broader 'has store access' check rather than the specific capability; the token itself may carry the privilege the UI no longer shows.