# Privilege Escalation - A `MEMBER` with no ACCESS to `ORDERS` can still access the orders by using  `Order Printer APP` 

A Shopify staff MEMBER without orders permission could read store orders via the Order Printer app, which used offline API access and never checked the requesting user's privileges.

- Payout: $1,000
- Severity: medium
- Program: Shopify
- Credited: coolboss
- Disclosed: 2016-04-20
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/64164
- Library page: https://bugbountylibrary.com/r/h1%3A64164
- Tags: domain:web impact:data-leak impact:privesc kind:bounty platform:hackerone sev:medium tech:oauth vuln:access-control vuln:idor vuln:privilege-escalation

**Target:** Order Printer app (Shopify app ecosystem, offline OAuth access)
**Root cause:** Apps used offline API access mode, where the app's token carries store-wide scopes independent of the logged-in user; apps did not verify the individual user's privileges before requesting/displaying store data.
**Steps:**
1. Log in as a store MEMBER account with no permission for ORDERS.
2. Open the Order Printer app from the admin.
3. App uses its offline access token to fetch orders and renders them to the low-privilege member.
4. Observe order data accessible despite missing ORDERS permission.
**How found:** Researcher noticed the app ecosystem has no built-in way to verify who is using an app, hypothesized apps don't check user privileges, and tested a no-ORDERS member against Order Printer.
**Exploitation:** A low-privileged staff member opens an installed app (Order Printer) that holds an offline access token with store-wide scopes; the app fetches and displays orders without checking the member's own permissions, leaking order data to an unauthorized user.
**Insight:** In multi-tenant SaaS app ecosystems, installed apps holding store-wide offline tokens are a privilege-escalation surface: test every installed app as a minimally-privileged staff user, since app tokens bypass per-user permission checks.