In klever-go versions before 1.7.20, the KleverUpdateAccountPermission built-in function authorizes permission replacement by checking vmInput.RecipientAddr, which can be attacker-controlled, instead of the authenticated vmInput.CallerAddr. This incorrect authorization (CWE-863) allows an attacker-controlled contract to specify a victim account as RecipientAddr. The contractHasValidPermission function then incorrectly accepts the victim's default self-signer as valid authorization. Consequently, the attacker can replace the victim's entire permission set with attacker-supplied Owner permissions, enabling asset theft or permanent lockout without requiring the victim's key or signature. The vulnerability does not affect accounts without stored permissions or the native transaction path. The vulnerability is resolved in klever-go version 1.7.20.

An attacker can escalate privileges on victim accounts by replacing their permission sets with attacker-controlled owner permissions. This enables theft of assets or permanent lockout of the victim account without needing the victim's private key or signature. The vulnerability affects accounts with stored permissions and can lead to severe compromise of account control and assets.

Upgrade klever-go to version 1.7.20 or later, where this authorization flaw is fixed. No other mitigation is required as the issue is resolved in the official fix.