{"action":"Upgrade github.com/klever-io/klever-go to 1.7.20 or later.","affected":[{"fixed":"1.7.20","introduced":"0"}],"component":"github.com/klever-io/klever-go","cve_ids":["CVE-2026-82405"],"ecosystem":"Go","epss":0.00427,"exploited":false,"fixed_versions":["1.7.20"],"ghsa_id":"GHSA-97cv-x867-6xhm","id":"tcs_01M5KF53S6E66YGHEGQYRVBSA7","modified_at":"2026-10-01T20:56:19.906249303Z","published_at":"2026-09-23T19:27:08Z","references":["https://osv.dev/vulnerability/GHSA-97cv-x867-6xhm","https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm","https://github.com/klever-io/klever-go/commit/c58740eb74d7ee8f07db1e18a7d6214b5559ba32","https://gist.github.com/mabdullah22/a41f90aa5ba86bbebf121f739bd5f5e9","https://github.com/klever-io/klever-go","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-97cv-x867-6xhm","url":"https://osv.dev/vulnerability/GHSA-97cv-x867-6xhm"}],"summary":"Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller"}