The KleverUpdateAccountPermission function incorrectly authorizes permission changes by inspecting the attacker‑controlled RecipientAddr instead of the authenticated CallerAddr. This flaw allows a malicious contract to select a target account, have the contract’s permission logic treat the target’s default signer as valid, and then replace the victim’s entire permission set with attacker‑supplied owner rights. Consequently, attackers can steal assets, lock the victim out, or otherwise abuse the affected account without possessing the victim’s key or signature. The vulnerability is a classic authorization bypass and is categorized under CWE‑863.

This issue affects the Klever‑io Klever‑Go implementation versions earlier than 1.7.20. Only accounts that have stored permissions are impacted; accounts lacking stored permissions and those transacting via the native transaction path remain unaffected. The vulnerability is fixed in release 1.7.20.

The CVSS score is 8.7, indicating a high severity of impact and exploitability. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves deploying a malicious contract that calls KleverUpdateAccountPermission, providing a carefully chosen RecipientAddr tied to a target account. The attacker must control the contract environment and can trigger the exploit remotely through normal contract execution. Given the high impact and the absence of public mitigation efforts, rapid patching is advised to reduce the risk of exploitation.