Vulnerability · Published Oct 6, 2026 · Assigned by certcc

CVE-2026-106511CVE-2026-106511

Critical 9.8

In plain English

A critical-severity missing authorization in multisig-improved from MultiversX Labs S.R.L.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 59.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.

Affected products (as reported)

Vendor	Product	Versions
MultiversX Labs S.R.L.	multisig-improved	GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299

Weakness: CWE-862, CWE-863, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References