How a Security Researcher Earned $1,900 Bounty for Privilege Escalation

Bug Bounty Reports Explained

A security researcher, Samux, discovered a privilege escalation vulnerability in Shopify’s Partner Portal (partners.shopify.com). This flaw allowed users without the necessary permissions to create unauthorized referrals by exploiting an unprotected API endpoint. The issue was promptly triaged, resolved, and ultimately earned Samux a bounty of $1,900.

Shopify’s Partner Portal features a referral system where users with specific permissions can submit POS (Point of Sale) leads. However, while the frontend properly enforced restrictions, the backend API did not have adequate authorization checks. This allowed users without “View referrals” permission to directly access the lead creation URL and submit unauthorized referrals.