A high-severity authorization bypass in Klever-Go permits authenticated attackers to hijack account permissions and steal assets or cause permanent lockouts.

The vulnerability exists in the KleverUpdateAccountPermission built-in, which incorrectly validates permissions against an attacker-controlled recipient address instead of the authenticated caller address. This flaw allows a malicious contract to overwrite the permission set of any victim account, effectively granting the attacker full control over the target.

The vulnerability poses a severe threat to the integrity of the Klever blockchain ecosystem, as it facilitates direct asset theft and permanent denial of service for user accounts. With a CVSS score of 8.7, the exploit demonstrates a high potential for financial loss and significant reputational damage to entities relying on the affected protocol.

Immediate Action: Update the Klever-Go implementation to version 1.7.20 or later, which addresses the incorrect authorization check.

Proactive Monitoring: Monitor blockchain transaction logs for suspicious calls to the UpdatePermission function, particularly those originating from untrusted or unknown smart contracts.

Compensating Controls: Implement strict validation logic within smart contracts to verify the identity of the caller and ensure that permission-related transactions are restricted to authorized administrative entities.

Public Exploit Available: Yes, a public proof-of-concept exists as detailed in the researcher's gist referenced in the security advisory.

The severity of this flaw necessitates immediate attention from all administrators managing Klever-Go nodes. Given the potential for total account compromise, organizations must prioritize patching to version 1.7.20 to eliminate the risk of unauthorized permission modifications and safeguard stored assets.