CVE-2026-106511CWE-306CWE-862CWE-863broken-access-control

CVE-2026-106511

Critical · published October 6, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
30.4
In the wild
Unconfirmed
What it is

MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00376 · 30.4th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-862 · Missing Authorization; CWE-863 · Incorrect Authorization
Published
2026-10-06T23:18Z
References (3)
https://gist.github.com/x01griax/c03f4be898dc55ccf3bab667c83c7312 · [email protected]https://github.com/multiversx/mx-multisig-and-modules · [email protected]https://gist.github.com/x01griax/c03f4be898dc55ccf3bab667c83c7312 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 06 OCT 18:52Z
    CVE-2026-106511
    cvelistv5