# Ability to bypass partner email confirmation to take over any store given an employee email

Race condition in Shopify Partners email verification let attacker confirm a victim employee's email, then auto-convert their staff account to collaborator and take over the store.

- Payout: $15,250
- Severity: critical
- Program: Shopify
- Credited: cache-money
- Disclosed: 2018-02-07
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/300305
- Library page: https://bugbountylibrary.com/r/h1%3A300305
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:critical technique:chained technique:race-window vuln:account-takeover vuln:auth-bypass vuln:business-logic vuln:race-condition

**Target:** partners.shopify.com email change/confirmation flow
**Root cause:** Email change and email verification were not performed in a single DB transaction, so a confirmation token for an attacker-owned email could validate a subsequently-set victim email (TOCTOU).
**Steps:**
1. Create store account and invite an employee (accept invite).
2. Create/login partner account as attacker.
3. At `https://partners.shopify.com/[ID]/settings` change email to one you own.
4. Grab confirmation link from email, don't visit.
5. Change email to victim employee's address; intercept request.
6. Release the change-email request, wait ~1100-2500ms, then visit the old confirmation link in another tab.
7. Email now confirmed for an address you don't own.
8. Visit `https://partners.shopify.com/[ID]/managed_stores`, add the store to gain collaborator access.
**How found:** Read prior report #270981 describing auto-conversion of existing store users to collaborators; realized confirming an employee's email on a partner account would trigger that conversion, then found email confirmation could be raced.
**Exploitation:** Attacker confirms victim employee email on partner account via race, then adds the store as managed store; Shopify auto-converts the matching staff account into a collaborator on the attacker's dashboard without merchant interaction, granting store access.
**Escalation:** Chained email-confirmation race with the auto-conversion of existing staff accounts to collaborators, escalating from email verification bypass to full store takeover.
**Insight:** When a feature auto-links accounts by matching email, the email-verification step becomes the trust anchor—hunt for TOCTOU between email-change and confirmation-token validation, and time the confirmation click against the change-email request latency.