On September 28th, 2017, a bug bounty hunter called uzsunny reported a vulnerability on Shopify.

They got admin access by creating two different accounts that share the same email address. The application had the option to define profiles for each user. In this case, Shopify had a profiled called collaborator, which had more privileges than normal user accounts. To get these privileges, the user needed to request the collaborator profile. When the application collaborated with the account, the other account, which was different, automatically got the same privileges. What's more, the other account had access to the sites controlled by the other account with the same privileges.

These kind of problems are more common than you think. From the developer's perspective, it is difficult to implement the user management modules and the authorization modules.

Usually you can implement the authorization privileges, and developers create an access matrix, where the application's sections versus the user's profiles are defined. But, as in this case, when an application is sharing information or needs with more than one authorization matrix, developers create assumptions, where the developer never thought that the same email address could access the same sites.

As a tip, to find this type of vulnerability, I recommend testing all the sections that you find using the spider with all the users you have. Usually, in bounty programs, at least two users of each level of access are provided. If not, create different users with different accounts and with the same accounts; if you think you find some strange behavior in a restricted section, ask for a user, explaining your thoughts. It is possible that the owners will provide you access to tests.