# Privilege Escalation in Point Of Sale Application from POS Manage Staff Role to potentially Store Owner

POS staff with only Manage Staff permission navigated embedded admin links up to Plan & Permissions, gaining store-owner settings like adding staff and transfer ownership.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: imgnotfound
- Disclosed: 2020-11-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/985150
- Library page: https://bugbountylibrary.com/r/h1%3A985150
- Tags: area:web domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:medium tech:payment technique:chained vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** Shopify Point of Sale app embedded admin navigation
**Root cause:** POS embedded webview exposes a navigation path from the Manage POS Roles listing into the Shopify admin Plan & Permissions settings, which trusts the physically authenticated POS user rather than enforcing the POS role's scoped permissions.
**Steps:**
1. Create a staff with Full Permissions and a POS user with only Manage Staff permission.
2. Log into POS app as admin, then enter the POS user's PIN.
3. Go to Staff, select the full-permission staff, change its PIN to `1234`.
4. Lock screen and log back in with PIN `1234` to gain full permissions in the app.
5. Go to Staff, edit POS APP ACCESS, click `Manage POS Roles`.
6. Open the full-permission role, scroll to Assigned Staff, click the staff.
7. Click `Manage Shopify admin access` to open the staff page under Plan and Permissions.
8. Click the `Plan and Permissions` breadcrumb to reach `https://shop.myshopify.com/admin/settings/account`.
9. Use owner features: add/manage staff, update login service, transfer ownership.
**How found:** Researcher explored the POS app and noticed it was possible to navigate from the POS application up to the Plan & Permissions admin view via nested links, suspecting unintended privilege boundary crossing.
**Exploitation:** Attacker with physical access to a POS terminal and a Manage Staff POS role logs in, resets a full-permission staff PIN, re-authenticates as that staff, then uses nested embedded links to reach the admin Plan & Permissions page and perform owner-level actions such as adding staff or initiating ownership transfer (owner password still required).
**Escalation:** Chained POS role escalation (PIN reset of higher-privileged staff) with UI navigation breakout to admin settings, reaching store-owner capabilities and potentially bypassing 2FA on ownership transfer.
**Insight:** In embedded webviews, follow every breadcrumb and 'manage' link from a low-privilege surface; UI navigation paths can cross into admin routes that trust the device-authenticated session rather than the scoped role.