MultiversX multisig-improved CVE-2026-106511

Exploitation requires the attacker to control an account that has been assigned the Proposer role on a deployed instance of the MultiversX multisig-improved smart contract built from the vulnerable commit (2e6dbea40f9b8ac165572a9efd4304804762a299); the flaw is the absence of an independent authorization check that should bar Proposers from fund-moving actions. Limiting factors: the attacker is not a fully anonymous outsider - they must already hold the Proposer role on the specific contract, and the target must be a multisig deployment using the unpatched code. No board signatures or additional user interaction are required once the role is held, and the full balance is drainable in two transactions.

The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as critical and network-exploitable with no privileges, consistent with CWE-306 (Missing Authentication/Authorization for a Critical Function) and the 'Authentication Bypass' tag. However, there is an important internal conflict: the description states the actor must be 'any account with the Proposer role,' which is a pre-assigned contract role - so this is really a broken-authorization / privilege-escalation flaw (a Proposer doing what only signers should do), not a fully anonymous unauthenticated action. The PR:N scoring is defensible only if one treats the Proposer role as an intended low-trust participant who should never be able to move funds; in practice the attacker must already hold that role, which narrows the exploit population - verify this nuance against the vendor advisory. Signals diverge: a POC exists publicly (a gist) and technical impact is total (100% of EGLD/ESDT drained in two transactions with zero signatures), yet EPSS is very low (0.15%, 3rd percentile) and the CVE is NOT in CISA KEV, indicating no evidence of widespread automated exploitation. On balance this is a genuine high-severity correctness/security defect in on-chain funds handling with a working POC, but real-world mass exploitation risk is tempered by the requirement to hold a Proposer role on a specific vulnerable multisig deployment rather than attacking the internet at large.

An attacker who has been granted (or has compromised an account holding) the Proposer role on a deployed multisig-improved contract issues two transactions that invoke fund-moving actions the Proposer should be barred from, transferring the full EGLD/ESDT balance to an attacker-controlled address with no board signatures. Publicly available POC code exists (a GitHub gist), lowering the skill needed; the low CVSS attack complexity (AC:L) means no special timing or race conditions are required once the role is held.