Regarding the PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619), we have reviewed their impact on all of our Shopify apps: Japan Order CSV, Delete Me, Mockingbird, Mypage Blocks, and B2E, our employee sales app. None of these apps use PHP, so they are not affected by these vulnerabilities. Merchants using our apps do not need to take any action, such as updating or changing settings.

We continuously monitor published vulnerability information and will notify our users promptly if any impact is expected. If you have any questions about this matter, please contact the support desk for the app you use.

Customer Account API

Definition

The Customer Account API is a standalone GraphQL API purpose-built for customers to self-manage their own data. It comes with its own authentication system for the new customer accounts, and provides full CRUD access to data scoped to the authenticated customer — profile information, order history, saved addresses, and more. From a Customer Account UI Extension, it can be called directly via fetch() against shopify://customer-account/api/.../graphql.json, with authentication handled automatically; it's used the same way in headless setups such as Hydrogen.

Background

Customer data used to be handled through a combination of the Storefront API and parts of the Admin API, neither of which was really designed with customer self-service in mind. As part of a broader push to tighten protection around customer data, Shopify introduced the Customer Account API specifically for this purpose — and today, the new customer accounts, Customer Account UI Extensions, and headless setups like Hydrogen are all organized around this API as their shared foundation.

Flagship's Involvement

On new-customer-account migration projects, Flagship designs and builds custom UI extensions (such as Mypage Blocks) on top of the Customer Account API. We implement requirements essential to Japanese e-commerce — furigana input, per-address kana data — on top of this API, in combination with Shopify's standard metafields.