Authorization Bypass in Electrum Wallet by Electrum Technologies
CVE-2026-117602

8.6HIGH

Key Information:

Vendor

Spesmilo

Status
Electrum
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117602?

Electrum Wallet versions prior to 4.7.2 are susceptible to an authorization bypass due to improper verification of plugin-signature passwords. This flaw allows an attacker with local access to the Electrum data directory to insert malicious plugin code into the plugins/ folder, subsequently marking it as enabled. The result is arbitrary code execution within the context of the Electrum process, significantly compromising the application's security and user data integrity. Users are urged to upgrade to the latest version to mitigate this vulnerability.

Affected Version(s)

electrum 0 < 4.7.2

electrum 4.7.2

References

https://github.com/spesmilo/electrum/security/advisories/...
vendor-advisory
https://github.com/spesmilo/electrum/commit/032dfcf107da1...
patch
https://github.com/spesmilo/electrum/commit/fd7164d6dc156...
patch

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.