# create staff member without owner access

A limited admin could create a POS staff user via the users.json API, then password-recover it into a full-access admin, bypassing owner-only staff creation.

- Payout: $1,000
- Severity: high
- Program: Shopify
- Credited: supernatural
- Disclosed: 2016-02-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/90688
- Library page: https://bugbountylibrary.com/r/h1%3A90688
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** Shopify admin users API (admin/users.json) and auth recovery flow
**Root cause:** The admin/users.json endpoint authorized any full-access admin token to create users, and the created POS staff user could be converted to a normal limited-access admin via password recovery, then escalated to full access by an existing full admin.
**Steps:**
1. Obtain an access token for a full-access admin (via xauth or sniffing from mobile device)
2. `POST https://~ShopName~.myshopify.com/admin/users.json` with body `{"user":{"email":"anyvalidmail@valid.com","first_name":"~fname~","last_name":"~lname~","pin":1234}}`
3. User is created as POS staff member with no admin access
4. Go to `https://~ShopName~.myshopify.com/admin/auth/recover` and enter the new email, follow reset instructions
5. After password recovery the user converts to a normal limited-access admin
6. From the full-access admin, select the new admin and unselect limited access to grant full access
**How found:** Reporter read prior report #56726 stating only the store owner may create staff members, then tested whether the users.json API enforced that restriction for admins and found it did not.
**Exploitation:** An admin (not owner) uses their API token to create a POS staff user, recovers its password to promote it to limited admin, then uses their own full-access admin panel to remove the limited-access restriction, yielding a full-access admin account despite owner-only staff creation policy.
**Escalation:** POS staff user -> limited-access admin via password recovery -> full-access admin by unchecking limited access in the admin UI.
**Insight:** When a UI enforces an owner-only policy, test the underlying REST endpoint directly with a lower-privileged token; also check whether newly created low-privilege objects can be promoted through adjacent flows like password recovery.