Missing authorization lets MultiversX multisig proposers move funds
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-306.
Summary
MultiversX multisig-improved, the reference multisig implementation in the mx-multisig-and-modules repository, is affected from GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299. A missing independent authorization check (CWE-862) lets any account with the Proposer role perform actions that are explicitly barred to it. An account with the Proposer role can move funds alone and drain the full EGLD and ESDT balance of a contract with zero signatures.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MultiversX Labs S.R.L. | multisig-improved | GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299 | — | No fix listed | CNA |
- multisig-improved VendorMultiversX Labs S.R.L. Affected GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for multisig-improved.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-06 Threatist record created from CVE-2026-106511
- 2026-10-07 Alias added: GHSA-vxx8-8p7v-9mvp
- 2026-10-07 1 new reference · CNA
- 2026-10-07 CVSS score added · CISA ADP
- 2026-10-07 Weakness changed · CISA ADP
- 2026-10-07 CISA SSVC decision points changed
- 2026-10-07 Priority changed: LOW → HIGH
References
Sources
- CVE-2026-106511 · CVE Program
- CVE-2026-106511 · NVD
- FIRST EPSS
- GHSA-vxx8-8p7v-9mvp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences