A flaw in MultiversX’s reference implementation of the on‑chain multisig contract, known as multisig‑improved, removes an independent authorization check. As a result, any account that holds the Proposer role can execute actions that the contract expressly forbids. With this defect an attacker can move all of the contract’s EGLD or ESDT balance in just two on‑chain transactions requiring no additional signatures beyond those already granted to the Proposer. This is a classic case of missing authorization control (CWE‑306, CWE‑862, CWE‑863) that leads to a full draining of funds.

The vulnerability impacts every deployment of the MultiversX multisig‑improved contract distributed through the mx‑multisig‑and‑modules GitHub repository. All versions of this reference implementation that have not been updated to the patched release are vulnerable. The vendor is MultiversX Labs S.R.L., and any contract that relies on the Proposer role for transaction approval is at risk unless the code is replaced with the latest fixed version.

The CVSS score of 9.8 classifies the issue as critical. The EPSS score is less than 1%, indicating a very low exploitation probability at the time of analysis, yet the impact remains severe. The vulnerability can be exercised by sending an on‑chain transaction from an account that holds the Proposer role; no special conditions or additional privileges are required beyond the existing role assignment. Because it is not listed in the CISA KEV catalog, no widespread exploitation advice is currently documented.