CVE-2026-106511

UNKNOWN 0.0

CVE-2026-106511

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.

Vendor	multiversx labs s.r.l.
Product	multisig-improved
Published	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for multiversx labs s.r.l. multisig-improved

Be the first to know when new unknown vulnerabilities affecting multiversx labs s.r.l. multisig-improved are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

MultiversX Labs S.R.L. / multisig-improved

GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/multiversx/mx-multisig-and-modules