# Paid account can review\download any invoice of any other shop

Paid Shopify store owner could change the invoice number in the admin URL to view and download any other store's invoice, leaking owner name, address and billing details.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: dvl
- Disclosed: 2015-10-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/94899
- Library page: https://bugbountylibrary.com/r/h1%3A94899
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:idor

**Target:** Shopify admin invoice endpoint (/admin/settings/account/invoice/{id} and /admin/invoices/{id}.pdf)
**Root cause:** Invoice endpoints authorized the request against the caller's own store but did not verify that the requested invoice number belonged to that store, so any invoice ID was retrievable.
**Steps:**
1. Authenticate to a paid (non-developer) Shopify store as shop owner.
2. Open invoices and change the trailing invoice number in `https://myshop.myshopify.com/admin/settings/account/invoice/1746632`.
3. Request `https://myshop.myshopify.com/admin/invoices/1746632.pdf` to download another store's invoice PDF.
**How found:** Noticed the invoice number was a direct, sequential identifier in the admin URL and tried changing it, observing another store's invoice rendered.
**Exploitation:** Enumerate/alter the sequential invoice number in the admin invoice URL to retrieve other stores' invoices; the HTML view exposes financial details and the PDF exposes shop address, owner email and full billing information (name, address, amount).
**Insight:** Sequential numeric IDs in authenticated admin URLs (invoice/receipt/statement endpoints) are prime IDOR candidates; test both the HTML view and the PDF/export variant, since exports often skip the ownership check the HTML page has.