CVE-2026-106511

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: CERT/CC

Description

MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106511

EUVD

EUVD-2026-93662

Affected Vendors & Products

Vendor	Product	Version / Range
MultiversX	Labs	S.R.L. multisig-improved GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is in MultiversX's multisig-improved smart contract system. It allows an account with the Proposer role to bypass authorization checks and perform actions that should require multiple signatures. Specifically, a Proposer can drain 100% of a contract's EGLD/ESDT balance in two transactions without any additional approvals.

Detection Guidance

This vulnerability cannot be detected via standard network or system commands as it involves a smart contract authorization flaw. Review the multisig-improved contract code for missing independent authorization checks on Proposer actions. Look for functions that allow fund transfers without requiring multiple signatures.

Impact Analysis

If you use or interact with the affected MultiversX multisig-improved smart contracts, an attacker with the Proposer role could steal all funds held in the contract. This could lead to complete financial loss for users or organizations relying on these contracts for secure fund management.

Compliance Impact

This vulnerability could lead to unauthorized fund transfers, violating financial integrity requirements in GDPR (data protection) and HIPAA (healthcare data). Organizations using these contracts may fail compliance audits due to inadequate access controls and financial safeguards.

Mitigation Strategies

Immediately revoke or restrict the Proposer role permissions in the multisig contract to prevent unauthorized fund movements. Review all multisig contracts for unauthorized transactions and audit their access controls.

Hi! I’m here to help you understand CVE-2026-106511. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70