CVE-2026-82405

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20

Description An issue exists in the KleverUpdateAccountPermission built-in function where the authorization check incorrectly uses the vmInput.RecipientAddr variable instead of the authenticated vmInput.CallerAddr. This allows an attacker-controlled smart contract to specify a victim account as the RecipientAddr, which the system then validates against the victim's own default self-signer permissions. Consequently, the UpdatePermission() function can be used to replace the victim's entire permission set with attacker-supplied Owner permissions. This can lead to full account takeover, enabling the theft of assets or permanent lockout of the account without requiring the victim's private key or signature. This issue specifically affects accounts with configured permissions; accounts without stored permissions and the native transaction path are not affected.

Recommendations Update Klever-Go to version 1.7.20. As a temporary mitigation, restrict the use of the KleverUpdateAccountPermission function via smart contracts until the update is applied.