# Disclose Any Store products, Files, Purchase Orders Via Email through Shopify Stocky APP

Stocky app's send-email endpoint accepted arbitrary purchase_order_id, letting any user email another store's purchase orders, files and images to themselves.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: securitzboy
- Disclosed: 2020-02-02
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/763994
- Library page: https://bugbountylibrary.com/r/h1%3A763994
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:idor

**Target:** Stocky web app POST /messages email-send endpoint
**Root cause:** The send-to-email action trusted the client-supplied message[purchase_order_id] without verifying it belongs to the authenticated user's store, so any PO ID could be rendered and emailed.
**Steps:**
1. Install Stocky app, land on https://app.stockyhq.com
2. Create a purchase order and click 'send to email', intercept the POST /messages request
3. Change `message[to]` to attacker email and `message[purchase_order_id]` to the victim's PO ID (e.g. `VICTIMID`)
4. Forward request; server returns 302 and emails the victim's PO PDF, files and images to the attacker
**How found:** Researcher intercepted the 'send to email' request and noticed purchase_order_id was a client-controlled parameter, then swapped it for another store's ID.
**Exploitation:** Authenticated attacker with any Stocky store submits the send-email form with a victim purchase_order_id and their own email address; the app renders and emails the victim's purchase order PDF plus attached files/images to the attacker.
**Insight:** On multi-tenant SaaS, any object ID passed in a form body (not just URL path) for server-side rendering/email actions is an IDOR candidate — test email/export endpoints where the object is re-fetched server-side.