{"id":"EUVD-2026-85648","enisaUuid":"2c13e03f-28a3-360d-883f-b4eba68d1251","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account\u0027s permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An attacker-controlled contract can choose a victim account with configured permissions as RecipientAddr, and contractHasValidPermission can accept the victim\u0027s default self-signer as authorization. UpdatePermission can then replace the victim\u0027s entire permission set with attacker-supplied Owner permissions, enabling asset theft or permanent lockout without a victim key or signature. Accounts without stored permissions and the native transaction path are not affected. This issue is fixed in version 1.7.20.","datePublished":"Sep 23, 2026, 7:26:12 PM","dateUpdated":"Sep 24, 2026, 3:05:37 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm\nhttps://github.com/klever-io/klever-go/commit/c58740eb74d7ee8f07db1e18a7d6214b5559ba32\nhttps://gist.github.com/mabdullah22/a41f90aa5ba86bbebf121f739bd5f5e9\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.20\n","aliases":"CVE-2026-82405\nGHSA-97cv-x867-6xhm\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"d6638526-7e33-3d9d-aa43-773ed20e8310","product":{"name":"klever-go","vendor":{"name":"klever-io"}},"product_version":"\u003c 1.7.20"}],"enisaIdVendor":[{"id":"8253d64b-63e8-33ee-9fec-205752f6ee38","vendor":{"name":"klever-io"}}],"enisaIdVulnerability":[{"id":"bce70a18-64bd-3294-a589-75ade6400430","vulnerability":{"id":"GHSA-97cv-x867-6xhm","description":"Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller","datePublished":"Sep 23, 2026, 7:27:08 PM","dateUpdated":"Sep 23, 2026, 7:27:08 PM","baseScore":0.0,"references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm\nhttps://github.com/klever-io/klever-go/commit/c58740eb74d7ee8f07db1e18a7d6214b5559ba32\nhttps://gist.github.com/mabdullah22/a41f90aa5ba86bbebf121f739bd5f5e9\nhttps://github.com/klever-io/klever-go\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.20\n","enisa_id":"EUVD-2026-85648\n","aliases":"CVE-2026-82405\nGHSA-97cv-x867-6xhm\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f2d73ca0-d85b-34d9-aa96-bd96752f1496","vulnerability":{"id":"CVE-2026-82405","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account\u0027s permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An attacker-controlled contract can choose a victim account with configured permissions as RecipientAddr, and contractHasValidPermission can accept the victim\u0027s default self-signer as authorization. UpdatePermission can then replace the victim\u0027s entire permission set with attacker-supplied Owner permissions, enabling asset theft or permanent lockout without a victim key or signature. Accounts without stored permissions and the native transaction path are not affected. This issue is fixed in version 1.7.20.","datePublished":"Sep 23, 2026, 7:26:12 PM","dateUpdated":"Sep 24, 2026, 3:05:37 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm\nhttps://github.com/klever-io/klever-go/commit/c58740eb74d7ee8f07db1e18a7d6214b5559ba32\nhttps://gist.github.com/mabdullah22/a41f90aa5ba86bbebf121f739bd5f5e9\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.20\n","enisa_id":"EUVD-2026-85648\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Oct 28, 2026, 7:19:59 AM","vulnerabilityProduct":[{"id":"79474073-8282-3158-be79-7126da3b1e6c","product":{"name":"klever-go","vendor":{"name":"klever-io"}},"product_version":"\u003c 1.7.20"}],"vulnerabilityVendor":[{"id":"4fcbc93e-a79d-3a66-bbe8-c937ceeaa4a8","vendor":{"name":"klever-io"}}]}}],"enisaIdAdvisory":[]}