# Low Privileged user can add or remove cash to/from sales register

Low-privileged Shopify POS user without register access could replay a GraphQL cashTrackingSessionAdjust mutation to add/remove cash and spoof another staff member's ID.

- Payout: hidden
- Severity: low
- Program: Shopify
- Found by: sandeep_rj49
- Disclosed: 2021-06-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/905543
- Library page: https://bugbountylibrary.com/r/h1%3A905543
- Tags: area:web3 domain:web impact:integrity kind:bounty platform:hackerone sev:low tech:graphql technique:source-review vuln:access-control vuln:business-logic vuln:privilege-escalation

**Target:** Shopify Admin GraphQL API (cashTrackingSessionAdjust mutation)
**Root cause:** The cashTrackingSessionAdjust GraphQL mutation lacks server-side permission checks, so a user without POS access can adjust cash tracking sessions and supply arbitrary staffMemberId.
**Steps:**
1. Add a low-privileged user with no Shopify POS access.
2. Capture the low-priv user's access token from `POST /admin/api/xauth` via the POS iOS app behind Burp.
3. Send `POST /admin/api/unversioned/graphql` with the `cashTrackingSessionAdjust` mutation, setting `sessionID` to an active cash tracking session and `staffMemberId` to another staff member's GID.
4. Use positive `money.amount` (e.g. `500`) to add cash, negative (e.g. `-500`) to remove; replay with the low-priv token.
**How found:** Researcher noticed the POS app's cash-tracking mutation and tested it with a low-privileged token, finding no server-side permission enforcement.
**Exploitation:** Replay the mutation with a low-privileged token to log cash entries attributed to another staff member, manipulating register cash balances without POS permission.
**Insight:** POS mobile app GraphQL mutations (cashTrackingSessionAdjust) may skip admin permission checks; test POS-only mutations with low-priv tokens and try substituting staffMemberId to spoof attribution.