Klever-IO Klever-Go up to 1.7.18 Marketplace Settlement market.go executeBuyMarket authorization

Summaryinfo

A vulnerability marked as problematic has been reported in Klever-IO Klever-Go up to 1.7.18. This affects the function executeBuyMarket of the file core/kapp/market/market.go of the component Marketplace Settlement. The manipulation leads to authorization. This vulnerability is uniquely identified as CVE-2026-54754. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Klever-IO Klever-Go up to 1.7.18. It has been rated as problematic. This issue affects the function executeBuyMarket of the file core/kapp/market/market.go of the component Marketplace Settlement. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity, and availability. The summary by CVE is:

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a valid listing and then use AssetTrigger UpdateRoyalties to make the combined referral and royalty percentages exceed the bid. executeBuyMarket pays referral and royalty amounts unconditionally while computeMarketOwnerAmount silently skips a nonpositive seller remainder, allowing MarketBuy, BuyItNow, or auction Claim settlement to credit more KLV or sale currency than the buyer paid. This can create unbacked currency and corrupt token supply integrity. This issue is fixed in version 1.7.19.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-54754 since 06/16/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.7.19 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Klever-IO

Name

• Klever-Go

Version

• 1.7.0
• 1.7.1
• 1.7.2
• 1.7.3
• 1.7.4
• 1.7.5
• 1.7.6
• 1.7.7
• 1.7.8
• 1.7.9
• 1.7.10
• 1.7.11
• 1.7.12
• 1.7.13
• 1.7.14
• 1.7.15
• 1.7.16
• 1.7.17
• 1.7.18

Website

• Product: https://github.com/klever-io/klever-go/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion