If one follows the framework defined in our library (here and here), the upgrade function has an additional param operator which should be, in most of the cases, the source account.
Add —operator which should be the same source account or can be overridden:
stellar contract invoke --id CBK.......BK4E --source alice --network testnet -- upgrade --new_wasm_hash ae9b.......6b89 --operator alice