# Removed staff members who had "Manage shops" permission can still create development stores

Removed Shopify Partners staff retained a non-expiring affiliate_shop signature, letting them create development stores tied to the organization after access revocation.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2019-11-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/254588
- Library page: https://bugbountylibrary.com/r/h1%3A254588
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** partners.shopify.com development store signup (app.shopify.com/services/signup/setup)
**Root cause:** The extra[affiliate_shop] signature linking a dev store to a partner org is static per organization and never expires or is invalidated on staff removal, so authorization is enforced only at page access, not at signup submission.
**Steps:**
1. Add staff member with 'Manage Shops' permission to org.
2. As that staff, open `https://partners.shopify.com/641767/development_stores/new` and copy `extra[affiliate_shop]` value from page source.
3. As owner, remove the staff member's access.
4. As the removed staff, POST the HTML form to `https://app.shopify.com/services/signup/setup` with `signup_types=affiliate_shop`, `signup_source=development+shop`, and the captured `extra[affiliate_shop]` signature.
5. As owner, visit `https://partners.shopify.com/[id]/development_stores` and observe the new store attached to the org.
**How found:** Noticed the affiliate_shop signature is identical across all staff of an org and does not expire; hypothesized it would still be accepted after staff removal and tested by replaying the form post-revocation.
**Exploitation:** A removed staff member replays the captured static affiliate_shop signature in a direct POST to the signup endpoint, bypassing the UI gate and creating development stores that appear under the organization's development_stores list.
**Insight:** When a token/signature is shared across users of a tenant and embedded in page source, test whether it is invalidated on membership change; replay it directly against the backend endpoint to bypass UI-level permission checks.