# H1514 Bypass Wholesale account signup restrictions

Wholesale invitation tokens were not bound to a store, so swapping the store domain in an invite link let an attacker register into any Wholesale store.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: cablej
- Disclosed: 2019-06-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/423496
- Library page: https://bugbountylibrary.com/r/h1%3A423496
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:medium technique:recon vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** Wholesale account invitation endpoint (invitation_token)
**Root cause:** The invitation acceptance endpoint validated the invitation_token without binding it to the store that issued it, so a token from one store was accepted by another.
**Steps:**
1. Configure Wholesale on two stores: target Store A (jackstore-7) and attacker Store B (jackstore-6).
2. As Store B, create a product/price list and add a customer to Wholesale.
3. On the Wholesale Customers page, generate an invite link: `https://jackstore-6.wholesale.shopifyapps.com/accounts/invitation/accept?invitation_token=KqhsT8sWFbbEdxpHxHt7`.
4. Replace the store domain in the link with Store A's domain.
5. Observe the token is still treated as valid for Store A and register an account.
6. Registered user gains access to the entire Wholesale store.
**How found:** Noticed signup is disabled by default and requires manual invites, then tested whether the invitation token was scoped to the issuing store by swapping the store domain in the accept link.
**Exploitation:** Attacker with their own Wholesale-enabled store generates a valid invitation token, then rewrites the host to the victim store's wholesale subdomain and completes registration, gaining full access to the victim's Wholesale store without an invite.
**Insight:** When a feature gates access via invite tokens, test whether the token is bound to the tenant/store — swap the host or store identifier in the accept URL and replay a token you legitimately own against another tenant.