# Bypass report #416983 - Removed Staff members who had "Apps" permission can still modify flow app connections

Removed Shopify Flow staff with Apps permission kept valid signed connector URLs, refreshing timestamp/path_hmac to retain access to Google Sheets/Trello/Asana connections indefinitely.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: mariogh
- Disclosed: 2019-10-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/698708
- Library page: https://bugbountylibrary.com/r/h1%3A698708
- Tags: area:web domain:web impact:integrity impact:internal-access kind:bounty platform:hackerone sev:medium tech:oauth technique:source-review vuln:access-control vuln:auth-bypass

**Target:** flow-connectors.shopifycloud.com signed connector URLs
**Root cause:** Signed URLs (timestamp + path_hmac) are not invalidated when staff membership is revoked; the connect/disconnect flow reissues fresh valid signatures to any holder of a still-valid URL, so access can be perpetually renewed.
**Steps:**
1. Add staff member with only Apps permission; install Shopify Flow.
2. As that user, visit `/admin/apps/flow/connectors` and connect Google Sheets/Trello/Asana.
3. Capture the redirect URL `https://flow-connectors.shopifycloud.com/gsheet/connect?shop_domain=...&shop_id=...&timestamp=[TIMESTAMP]&path_hmac=[PATH_HMAC]`.
4. As owner, remove the staff member.
5. Within 60 min, use saved URL to modify connector settings.
6. Click `Disconnect` then `Connect` any Google account to mint a fresh `timestamp` and `path_hmac`.
7. Repeat every ~45 min to retain access indefinitely.
**How found:** Noticed signed URLs use a timestamp with 1h validity and hypothesized revocation of staff wouldn't invalidate them; tested by removing the user and replaying the URL, then discovered Disconnect/Connect reissues valid signatures to the old URL holder.
**Exploitation:** Ex-staff replays the captured signed connector URL before expiry, then uses the Disconnect/Connect UI to regenerate fresh signatures, keeping persistent control of Flow connectors and redirecting workflow actions to attacker-owned accounts.
**Escalation:** Repeated signature refresh extends a 60-minute window indefinitely; admin re-issuing new signatures does not invalidate the attacker's URL.
**Insight:** When a signed URL gates a state-changing action, check whether the action itself mints a new signature for the same session — that turns a short-lived token into a perpetual one, surviving account revocation.