CVE-2026-82405 Details

A critical vulnerability has been identified in the Klever blockchain protocol implementation in Go, specifically in versions prior to 1.7.20. The issue arises in the built-in function 'KleverUpdateAccountPermission', which is supposed to update an account's permissions. Instead of verifying the action against the authenticated caller's address, the function erroneously relies on an address controlled by the attacker. This flaw enables an attacker to select a victim account and replace its permissions with their own, potentially leading to unauthorized access and control over the victim's assets. The vulnerability can be exploited by deploying a smart contract that manipulates the permission update process, without the need for direct access to the victim's keys or signatures.

Users are advised to update to Klever-Go version 1.7.20, which fixes the vulnerability by correctly authorizing permission updates against the authenticated caller's address instead of an attacker-controlled recipient address.