{"schema":"threatline.record/2","record":{"id":"CVE-2026-106511","aliases":[],"summary":"CVE-2026-106511","details":"MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.","categories":["Unclassified"],"product":"multisig-improved","vendor":"MultiversX Labs S.R.L.","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106511","source_modified_at":"2026-10-07T17:55:09.072Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"multisig-improved","vendor":"MultiversX Labs S.R.L.","versions":[{"status":"affected","version":"GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299"}],"defaultStatus":null}],"fixed_versions":[],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00376,"percentile":0.30413,"score_date":"2026-10-23"},"published_at":"2026-10-06T18:52:33.825Z","modified_at":"2026-10-07T17:55:09.072Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-106511","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-07T17:55:09.072Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106511","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/multiversx/mx-multisig-and-modules"},{"source":"CVE List","url":"https://gist.github.com/x01griax/c03f4be898dc55ccf3bab667c83c7312","tags":["exploit"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"total","assessed_at":"2026-10-07T17:53:21.355591Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T17:55:09.072Z","content_hash":"324e0e906ed623bf41e8f9b66da95453dd64b100e169bc3560eb75c911973974"}}