CVE-2026-106511

State: Published
Severity: 9.8 Critical
Published: Oct 6, 2026
Updated: Oct 7, 2026
Reserved: Oct 6, 2026

Description

MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-862 Missing Authorization
CWE-863 Incorrect Authorization
CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
multisig-improvedMultiversX Labs S.R.L.	GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.