# Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalation

Email verification bypass on legacy .myshopify.com accounts via Burp match-and-replace let an attacker confirm a victim's email and take over their store and partner account.

- Payout: hidden
- Severity: critical
- Program: Shopify
- Found by: say_ch33se
- Disclosed: 2020-09-15
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/910300
- Library page: https://bugbountylibrary.com/r/h1%3A910300
- Tags: area:web domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:critical tech:sso technique:param-pollution vuln:account-takeover vuln:auth-bypass vuln:privilege-escalation

**Target:** Legacy .myshopify.com admin account settings / email verification flow
**Root cause:** The email verification flow trusted the client-supplied email value (manipulable via Burp match-and-replace) rather than binding the confirmation token to the server-side account email, so a confirmation link issued for the attacker's own email could verify an arbitrary victim email.
**Steps:**
1. Create a partner account and a new store; leave the store email unverified.
2. Open `admin/settings/account/<account>` and change email to the victim's address.
3. Enable Burp match-and-replace swapping your email for the victim's email.
4. Refresh the account page so it reflects the victim email.
5. Upload a photo on the accounts page and save.
6. Disable match-and-replace, refresh, change email back to one you own to receive a confirmation email.
7. Re-enable match-and-replace to swap your email for the victim's.
8. Click the confirmation link sent to your own inbox while logged in.
9. On the verified page upload another image, click Review accounts, enter store password.
10. Set up Shopify ID and password to gain access to the victim's store and partner account.
**How found:** Researcher noticed the account settings page reflected a client-controlled email and tested whether a confirmation link issued for their own email could be replayed against a swapped victim email using Burp match-and-replace.
**Exploitation:** Attacker uses Burp match-and-replace to make the server associate the victim's email with the attacker's confirmation token, then clicks the confirmation link delivered to their own inbox, verifying the victim's email and completing Shopify ID setup to access the victim's store and partner account.
**Escalation:** Verified email is leveraged into Shopify ID SSO setup, escalating from email confirmation bypass to full account takeover of store and partner account (non-SSO accounts only).
**Insight:** When a verification link is emailed to you but the account email is set via a client-editable field, test whether the token is bound to the server-side email or merely to the session; match-and-replace the email between token issuance and click to detect the mismatch.