# H1514 Wholesale customer without checkout permission can complete purchases

Wholesale customers blocked from checkout could swap the purchase-order submit endpoint for update_checkout to bypass manual approval and pay immediately.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: cablej
- Disclosed: 2019-04-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/423546
- Library page: https://bugbountylibrary.com/r/h1%3A423546
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:legacy-endpoint vuln:access-control vuln:business-logic

**Target:** Wholesale purchase order checkout endpoint
**Root cause:** The /purchase_orders/update_checkout endpoint did not verify the customer's checkout permission, unlike the normal submit flow which enforced the admin's disable-checkout setting.
**Steps:**
1. As Wholesale owner, disable immediate checkout for a customer at /admin/apps/wholesale/admin/shops/x/accounts.
2. As the customer, add products to cart; UI forces a purchase order submission.
3. Intercept `PUT /purchase_orders/submit` and change the URL to `/purchase_orders/update_checkout`.
4. Replay the request; the customer proceeds through checkout and places the order.
**How found:** Noticed the UI enforced purchase-order-only flow, then tested whether an alternate checkout-related endpoint (update_checkout) enforced the same permission.
**Exploitation:** Customer replays the purchase-order submit request against the update_checkout endpoint, which lacks the permission check, triggering a regular checkout flow and immediate payment without staff approval.
**Insight:** When a feature gates an action in the UI, enumerate sibling endpoints of the same resource (submit vs update_checkout) — permission checks are often applied per-endpoint and one variant may skip the gate.