admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed

How it was found

Summary:

A staff user removed from a Shopify store continues to receive customer Personally Identifiable Information (PII) via a previously created automation workflow. The workflow, configured using Shopify Flow, continues executing after the user's access has been revoked and sends sensitive customer information to the removed user's email address.

This results in persistent unauthorized access to customer data, even after administrative removal of the user from the store.

This behavior demonstrates a post-privilege-revocation control failure, where backend authorization does not re-evaluate recipients configured in automation workflows after user removal.

Shops Used to Test:

https://admin.shopify.com/store/abah52

Steps To Reproduce:

1. Create User A with permission to create workflows.
2. Create User B (standard staff or admin user).
3. Log in as User A.
4. Navigate to Shopify Flow and create a new workflow:

Trigger:

• Customer Created

Action:

• Send Internal Email

5. Configure the email recipient as User A's email address.
6. Configure the email body to include customer PII fields:

Example:

Customer Name: {{customer.firstName}} {{customer.lastName}} Email: {{customer.email}} Phone: {{customer.phone}} Address: {{customer.defaultAddress.address1}} City: {{customer.defaultAddress.city}} Country: {{customer.defaultAddress.country}}

7. Save and enable the workflow.
8. Log in as User B and create a new customer.
9. Observe that User A receives email containing customer PII.
10. As Admin, remove User A from the store.
11. Wait for access revocation to fully propagate.
12. Log in as User B again.
13. Create another new customer.

Actual Result

Despite being removed from the store, User A still receives an email containing customer PII, including:

• Customer name
• Email address
• Phone number
• Physical address

Expected Result

Once a user is removed from a store:

• They should no longer receive customer data
• Automation workflows should re-evaluate recipients
• Removed users should not receive sensitive information

Impact

This issue allows a removed staff user to continue receiving sensitive customer information after access revocation. This creates a persistent data exposure risk and enables unauthorized access to customer PII.

Attack scenario:

An attacker joins a store as staff, creates a Shopify Flow automation that sends customer data to their email address, and is later removed from the store. Despite removal, the automation continues executing and sends new customer PII to the removed user.

This could allow:

• Former employees to continue receiving customer data
• Contractors removed from the store to retain access to sensitive information
• Malicious insiders to establish persistent data exfiltration mechanisms

The exposed data includes customer personally identifiable information (PII), such as:

• Customer names
• Email addresses
• Phone numbers
• Physical addresses

This results in unauthorized access to customer data and creates a privacy and security risk.

Evidence

A video proof of concept is attached demonstrating:

• Workflow creation
• Customer creation
• User removal
• Continued PII email delivery to removed user