# GraphQL AdminGenerateSessionPayload is leaked to staff with no permission

A no-permission staff member could call adminGenerateSession to mint app session tokens, accessing a subset of installed apps like Shopify Email within the shop.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: hiffley
- Disclosed: 2020-07-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/898528
- Library page: https://bugbountylibrary.com/r/h1%3A898528
- Tags: area:web domain:web impact:internal-access impact:privesc kind:bounty platform:hackerone sev:medium tech:graphql vuln:access-control vuln:auth-bypass

**Target:** GraphQL admin mutation adminGenerateSession
**Root cause:** The adminGenerateSession mutation lacked an Apps permission check, so any authenticated staff member could generate app session tokens regardless of role.
**Steps:**
1. Authenticate to Shopify admin as a staff member with no permissions.
2. Send `POST /admin/internal/web/graphql/core` with mutation `adminGenerateSession(appId: $appId) { session }` and a target `appId` GID.
3. Receive a valid app session token for the installed app.
4. Use the token to access the app (e.g. Shopify Email) within the current shop.
**Exploitation:** An unprivileged staff account issued the GraphQL mutation with a chosen appId to obtain a session token, then used it to access installed apps using the new flow, limited to the current shop.
**Insight:** Privileged GraphQL mutations that mint credentials often miss the same permission gate as their REST counterparts; test token-generation mutations from a zero-permission staff role.