# change Login Services settings without owner access

A settings-access admin could POST to /admin/shop.json and enable Google Apps login, a setting reserved for the shop owner, bypassing the permission model.

- Payout: $1,000
- Severity: medium
- Program: Shopify
- Credited: supernatural
- Disclosed: 2015-10-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/90690
- Library page: https://bugbountylibrary.com/r/h1%3A90690
- Tags: domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium tech:rest vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** Shopify admin shop.json API endpoint
**Root cause:** The /admin/shop.json endpoint did not enforce owner-only restriction on the google_apps_login_enabled and google_apps_domain fields, allowing any admin with settings access to modify them.
**Steps:**
1. Obtain an API access token for a full-access admin (via xauth or sniffing from mobile device)
2. Send `POST https://~ShopName~.myshopify.com/admin/shop.json` with body `{"shop":{"google_apps_domain":"anydomain","google_apps_login_enabled":true}}`
3. Observe the owner-only login service setting is changed despite lacking owner privileges
**How found:** Noticed the login service setting was only visible/editable to owners in the UI, then tested whether the underlying shop.json API enforced the same restriction and found it did not.
**Exploitation:** An admin with only settings access (not owner) used their API token to POST to shop.json and enable Google Apps login with an attacker-controlled domain, altering authentication configuration for staff.
**Insight:** When a UI hides a field from non-owner roles, test the backing REST endpoint directly with a lower-privileged token; UI-only restrictions often aren't mirrored in API authorization.