# Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permission

Shopify Flow app returned the store's admin API access token in a GraphQL shopInfo response, letting removed staff with Apps permission retain full read/write store access.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: mariogh
- Disclosed: 2019-10-10
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/700831
- Library page: https://bugbountylibrary.com/r/h1%3A700831
- Tags: area:web3 domain:web impact:data-leak impact:integrity impact:pii-leak kind:bounty platform:hackerone sev:medium tech:graphql technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Shopify Flow app GraphQL endpoint (flow.shopifycloud.com/graphql) and store Admin REST API
**Root cause:** The Flow app's shopInfo GraphQL response includes the store's admin API access token (shopifyToken), and that token is not revoked when a staff member with Apps permission is removed.
**Steps:**
1. Add a staff member with only 'Apps' permission and install the Flow app.
2. Log in as that staff member and open DevTools.
3. Navigate to `https://[Your-Shop].myshopify.com/admin/apps/flow/connectors`.
4. Filter requests to the Graph endpoint and find the shopInfo query.
5. Copy the `shopifyToken` value from the response.
6. As owner, remove the staff member.
7. Use the token against the Admin REST API, e.g. `GET /admin/orders.json` with header `X-Shopify-Access-Token: <token>`.
**How found:** Researcher exhaustively read every JS file and HTTP request/response of the Flow app; noticed the Connectors tab triggers a shopInfo GraphQL query whose response unexpectedly contained shopifyToken.
**Exploitation:** A removed staff member keeps the leaked shopifyToken and replays it in the X-Shopify-Access-Token header against the store's Admin REST API to read orders/customers and modify products, orders, inventory, etc., without any account.
**Insight:** When auditing OAuth/app-install flows, inspect every GraphQL response for fields the UI never displays — tokens and secrets often ride along in 'info' queries; also test whether app-scoped tokens survive staff removal.