{"id":"CVE-2026-106511","revision":"f7fa3df0eb0b435dabe4654832c77a3d","records":[{"revision":"f7fa3df0eb0b435dabe4654832c77a3d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-106511","aliases":[],"title":"CVE-2026-106511","description":"MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.","state":0,"publishedAt":"2026-10-06T18:52:33.825+00:00","modifiedAt":"2026-10-07T17:55:09.072+00:00","affected":[{"ecosystem":"Vendor product","name":"multisig-improved","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"MultiversX Labs S.R.L.\",\n                    \"product\": \"multisig-improved\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://github.com/multiversx/mx-multisig-and-modules","https://gist.github.com/x01griax/c03f4be898dc55ccf3bab667c83c7312"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106511","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-106511","identifiers":["CVE-2026-106511"]},"retained":false,"historicalAffected":[]}],"coverage":[]}