EUVD-2026-85648
GHSA-97cv-x867-6xhm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via on-chain contract call (AV:N, AC:L, UI:N); attacker needs a controlled account/contract so PR:L; full victim account takeover gives C/I/A High; scope kept Unchanged consistent with vendor 4.0 SC:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An attacker-controlled contract can choose a victim account with configured permissions as RecipientAddr, and contractHasValidPermission can accept the victim's default self-signer as authorization. UpdatePermission can then replace the victim's entire permission set with attacker-supplied Owner permissions, enabling asset theft or permanent lockout without a victim key or signature. Accounts without stored permissions and the native transaction path are not affected. This issue is fixed in version 1.7.20.
AnalysisAI
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker-controlled smart contract to replace a victim account's entire permission set without any victim key or signature. The handler authorizes updates using the attacker-supplied vmInput.RecipientAddr instead of the authenticated vmInput.CallerAddr, and because the default self-signer created by createDefaultOwnerPermission satisfies the contractHasValidPermission check, a contract can name any permissioned victim as recipient and install attacker-supplied Owner permissions - enabling asset theft or permanent lockout of the victim. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the attacker to be able to deploy or control a smart contract on the Klever chain that can issue an indirect built-in call (ExecuteOnDestContextWithTypedArgs), which is why this is low-privilege rather than fully unauthenticated, and (2) the victim account must already have a stored permission set - accounts with no configured permissions have an empty GetPermissions() and are immune, as is the native (non-contract) transaction path which correctly uses tx.GetSender(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Klever-Go to version 1.7.20, which contains the vendor-released patch (commit c58740eb74d7ee8f07db1e18a7d6214b5559ba32); the fix changes UpdatePermission to take explicit authorizer and target parameters and adds authorizerCanUpdatePermission, so an indirect contract caller can no longer authorize against a victim-chosen RecipientAddr. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Klever-Go deployments and confirm which are running versions prior to 1.7.20; restrict or temporarily disable smart-contract deployment and indirect built-in calls that can reach KleverUpdateAccountPermission; audit accounts with stored permissions for unexpected Owner or permission changes and enable enhanced logging/alerting. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only
zot container registry versions prior to 2.1.18 mis-map the HTTP DELETE method to the "push" scope action in its bearer
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today