# Staff can create workflows in Shopify Admin without apps permission

Low-privilege staff with only marketing permission reached the internal Flow GraphQL endpoint to install and activate hidden workflows, bypassing app/org-admin requirements.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: jmp_35p
- Disclosed: 2022-10-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1521336
- Library page: https://bugbountylibrary.com/r/h1%3A1521336
- Tags: area:web domain:web impact:privesc kind:bounty platform:hackerone sev:medium tech:graphql technique:recon vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** /admin/internal/web/graphql/flow GraphQL endpoint
**Root cause:** The internal Flow GraphQL endpoint lacks authorization checks tying access to the Flow app or org-admin permission, so any staff session can invoke templateInstall/workflowActivate mutations.
**Steps:**
1. Authenticate as staff with only `marketing` permission on a store.
2. Send `POST /admin/internal/web/graphql/flow` with valid admin session cookie and `X-Csrf-Token`.
3. Run introspection to enumerate mutations.
4. Send `templateInstall` mutation with a `templateId` to install a workflow template.
5. Send `workflowActivate` mutation with returned `workflowId`, `version`, `contextType:shop`, `contextId` to activate it.
6. Observe workflow (e.g. tag on customer registration) executes though not visible in Flow app.
**How found:** Researcher read public docs noting Flow is only reachable via org admin or the Flow app, then stumbled on the `/admin/internal/web/graphql/flow` endpoint and tested it with a low-privilege staff session, using introspection to find exposed mutations.
**Exploitation:** A staff member with marketing-only permission uses their admin session to call the internal Flow GraphQL endpoint directly, installing and activating arbitrary workflows (e.g. auto-tagging customers) that run server-side but remain hidden from the Flow UI.
**Insight:** Internal GraphQL endpoints under `/admin/internal/web/graphql/*` may skip the permission gating applied to the public app surface; enumerate them with introspection from a low-priv staff session and test mutations that the UI hides.