CVE-2026-106511: MultiversX Multisig-improved - Missing Authorization Check Lets Proposer Role Move Funds
A missing independent authorization check in the MultiversX multisig-improved reference implementation lets an account with the Proposer role perform actions that are explicitly barred, according to the record. The record rates it critical with a CVSS base score of 9.8 and states that it can drain a contract's full EGLD and ESDT balance. No fixed version is listed, and no confirmed exploitation appears in the sources consulted.
Overview
The record describes a missing independent authorization check in the MultiversX multisig-improved reference implementation of its on-chain multisig smart contract system. According to the record, an account holding the Proposer role can perform actions that the design explicitly bars.
Impact
The record states that the Proposer role can move funds on its own and drain the full EGLD and ESDT balance of a contract. The CVSS base score of 9.8 is rated critical, and the record assigns CWE-306, Missing Authentication for Critical Function.
Affected products and versions
- Product: MultiversX Labs S.R.L. Multisig-improved, repository mx-multisig-and-modules.
- The record identifies the affected code only by a single GitHub commit reference.
- No version ranges or fixed versions are listed, so this analysis does not state any version numbers.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog does not list this CVE according to the record. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is set to proof of concept, which suggests proof-of-concept material may exist but does not confirm active exploitation. The EPSS probability is 0.00376 with a percentile of 0.30413.
Remediation and mitigation
- No fixed version or patch is listed in the record, so check the upstream repository for maintainer updates.
- Until a verified fix is confirmed, review deployed multisig instances that use the affected code and limit which accounts hold the Proposer role.
- Require independent approval from multiple signers for fund movements and verify that role-based restrictions are enforced as the design intends.
- If the affected code cannot be confirmed as patched, consider pausing high-value contracts and seek guidance from the maintainers and a qualified security auditor.
Detection guidance
- Monitor contract activity for fund transfers that lack the expected number of signer approvals.
- Alert on Proposer-role accounts acting outside their intended scope, and review recent role assignment changes.
- Track balance drops in multisig contracts against an expected baseline.
Limitations of the available information
The record does not list fixed versions, detailed affected version ranges, or whether deployed contracts are impacted. Fix availability is unknown. The analysis is limited to the record and the references it lists.
Frequently asked questions
What does CVE-2026-106511 affect?
According to the record, it affects the MultiversX Labs Multisig-improved reference implementation from the mx-multisig-and-modules repository. The affected code is identified only by a GitHub commit reference.
Is this vulnerability being actively exploited?
The record shows the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. The SSVC field indicates proof-of-concept status only.
Is there a fix available?
The record lists no fixed version or patch. Fix availability is unknown, so check the upstream repository for maintainer updates and review deployed instances.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.