Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

MultiversX multisig-improved lets Proposer drain funds

CVE-2026-106511 · published 27 days ago
Summary

The MultiversX multisig‑improved smart contract code does not verify that a Proposer has separate permission before taking certain actions. Because of this, anyone assigned the Proposer role can move all the tokens in a contract by themselves, without any additional signatures. Apply the vendor’s latest update or replace the contract with a version that includes the missing check.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
multiversx labs s.r.l. multisig-improved GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299
Original advisory text
CVE-2026-106511
MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
CWE-863Incorrect Authorization
CWE-306Missing Authentication for Critical Function
Timeline
Published6 Oct 2026
Updated30 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-106511 · NVD
CVE-2026-106511 · MITRE
Track software like this
Free during beta