# H1514 Removed Staff members who had "Apps" permission can still modify flow app connections

Non-expiring path_hmac signed URLs in Shopify Flow connectors let removed staff reconnect Google Sheets/Trello/Asana and exfiltrate store data.

- Payout: hidden
- Severity: low
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2019-06-14
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/416983
- Library page: https://bugbountylibrary.com/r/h1%3A416983
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:low technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Flow connector OAuth connect endpoint (flow-connectors.shopifycloud.com)
**Root cause:** The connector connect endpoint authorizes solely via a static path_hmac over the path, identical for all staff and not tied to any session or permission check, and it never expires.
**Steps:**
1. Add staff member with only 'Apps' permission; install Flow app.
2. Log in as that staff member and visit `https://[shop].myshopify.com/admin/apps/flow/connectors`.
3. Click Settings next to Google Sheets, Trello, Asana and save the resulting `https://flow-connectors.shopifycloud.com/gsheet/connect?shop_domain=[shop].myshopify.com&shop_id=[shop-id]&path_hmac=[path_hmac]` URLs.
4. Owner removes the staff member.
5. Reuse saved URLs to modify connector settings and connect attacker accounts.
**How found:** Noticed the connect URL's only authorization was a path_hmac identical across staff and independent of session, then tested reuse after staff removal.
**Exploitation:** Former staff replays the saved signed URL to rebind Google Sheets/Trello/Asana connectors to their own accounts, so subsequent Flow workflow actions send store data to attacker-controlled accounts.
**Insight:** When a signed URL is the sole authz gate, check whether the signature covers identity/permission and whether it expires; replay after role revocation is the test.