# Ability to link a Google account to another staff account/store owner that isn't linked yet

POS GraphQL StaffMemberUpdate let a staff member change another staff/owner email to their own Google Apps address, linking their Google account and taking over the account.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: imgnotfound
- Disclosed: 2020-07-14
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/892904
- Library page: https://bugbountylibrary.com/r/h1%3A892904
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:graphql tech:oauth technique:incomplete-fix vuln:access-control vuln:account-takeover

**Target:** pos-channel.shopifycloud.com/graphql-proxy/admin GraphQL StaffMemberUpdate operation
**Root cause:** StaffMemberUpdate allowed a staff member to set another staff/owner's email to an arbitrary address; when Google Apps SSO is configured and the victim never linked Google, the attacker's Google identity becomes bound to the victim account.
**Steps:**
1. As staff with POS access, open POS > Staff and select target staff.
2. Capture the StaffMemberUpdate CURL request to `https://pos-channel.shopifycloud.com/graphql-proxy/admin`.
3. Change the `email` field in the payload to your own Google Apps domain email.
4. Logout and log back in via Google Apps with that email to access the victim account.
**How found:** Noticed prior fixes restricted email updates for store owners via StaffMemberUpdate but the owner could still update their own email; tested the endpoint as staff to change another unlinked staff's email.
**Exploitation:** Attacker with POS staff access replays StaffMemberUpdate with victim's email replaced by their own Google Apps address; on next Google login the attacker's Google identity is linked to the victim staff/owner account, granting that account's privileges.
**Escalation:** Chains with XSS against a shop owner to change the owner's email and link attacker's Google account, gaining full owner features.
**Insight:** When SSO linking is keyed on email, any endpoint that lets a lower-privileged user mutate another user's email becomes an account-linking takeover; check partial fixes that only block one role.