# Takeover an account that doesn't have a Shopify ID and more

POS staff GraphQL endpoint updated staff email without verification, letting attacker merge victim's store into a Shopify ID they control and take over the account.

- Payout: hidden
- Severity: critical
- Program: Shopify
- Found by: imgnotfound
- Disclosed: 2020-09-02
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/867513
- Library page: https://bugbountylibrary.com/r/h1%3A867513
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:critical tech:graphql technique:chained vuln:account-takeover vuln:business-logic

**Target:** pos-channel.shopifycloud.com/graphql-proxy/admin POS Staff endpoint
**Root cause:** The POS Staff admin GraphQL endpoint allowed updating a staff member's email without sending or requiring email confirmation, and the Shopify ID merge flow trusted that already-set email as verified.
**Steps:**
1. Create a development store via partners.shopify.com with an email you own that does not yet exist in Shopify (edit read-only field via `window.RailsData.current_organization.business_email` / `window.RailsData.user.email` or Burp).
2. Confirm ownership of that email via the sent link.
3. Add POS to the store's Sales Channels and open POS > Staff.
4. Save your own staff page, capture the CURL request.
5. Replace the email field in the CURL payload with the victim's email and send it.
6. Refresh your shop profile; you are prompted to combine accounts without validating the new (victim) email.
7. Proceed with Shopify ID creation to own a Shopify ID bound to the victim's email.
8. Change the Shopify ID email to yours to lock out the victim's recovery.
**How found:** Noticed the POS Staff save request accepted an arbitrary email without confirmation, and that the Shopify ID merge prompt did not re-validate the email, then combined with a dev store whose email was self-verified.
**Exploitation:** Attacker creates a dev store with a self-owned non-Shopify email, verifies it, then abuses the POS Staff endpoint to overwrite the staff email with the victim's unverified email. The merge flow treats it as verified, letting the attacker create a Shopify ID tied to the victim's email and then change it, locking the victim out.
**Escalation:** Chained two flaws: unverified email update via POS endpoint plus Shopify ID merge flow trusting the email, enabling takeover of accounts lacking a Shopify ID and also silent staff info swapping (name/email) between staff members.
**Insight:** Secondary admin GraphQL endpoints (POS staff) that mutate identity fields often skip the verification enforced by the main account UI; test whether downstream merge/SSO flows trust those fields as verified.