# A non-privileged user may create an admin account in Stocky

Non-privileged Stocky user could POST to /users/create_admin with their own session token to create a new admin account, gaining full admin privileges.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: stapia
- Disclosed: 2021-11-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1245736
- Library page: https://bugbountylibrary.com/r/h1%3A1245736
- Tags: area:web domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium tech:ruby vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** Stocky web app endpoint /users/create_admin
**Root cause:** The /users/create_admin endpoint lacked authorization checks, allowing any authenticated non-privileged user to create an admin account.
**Steps:**
1. Create a non-privileged user in Stocky without admin privileges.
2. Log in as that user, visit https://stocky.shopifyapps.com/users/me, update a field and intercept the request to capture cookies and authenticity_token.
3. Send `POST /users/create_admin` with the captured Cookie and `authenticity_token` plus `user[first_name]`, `user[last_name]`, `user[email]`, `commit=Create+%26+Login`.
4. Log out and log in with the new user; it has admin privileges.
**How found:** Researcher intercepted the profile-update request at /users/me to harvest cookies and authenticity_token, then replayed them against the /users/create_admin endpoint.
**Exploitation:** Attacker with a low-privileged Stocky account reuses their own session cookie and CSRF token to invoke the admin-only create_admin endpoint, minting a new admin user they control.
**Insight:** When a low-priv account can capture a valid CSRF token from any state-changing form, try replaying that token against sibling admin-only endpoints like create_admin; the token is often not scoped to the action.