Smart Contract Vulnerability in MultiversX Multisig Implementation

CVE-2026-106511

What is CVE-2026-106511?

The MultiversX multisig implementation presents a significant risk due to a lack of proper authorization checks. Specifically, the Proposer role is improperly enabled to execute actions that should require multiple signatures, permitting unauthorized fund transfers. In this instance, an account assigned to the Proposer role can drain the entire EGLD or ESDT balances from a contract in just two transactions, posing a serious threat to the security of assets managed through this multisig system.

References