CVE-2026-106511: CWE-862 Missing Authorization in MultiversX Labs S.R.L. multisig-improved

The multisig-improved reference implementation by MultiversX Labs S.R.L. contains a missing independent authorization check (CWE-862) that permits an account holding the Proposer role to perform actions explicitly barred by the contract's intended logic. This vulnerability enables the Proposer to move funds alone, effectively bypassing multisignature protections and draining 100% of the contract's EGLD/ESDT balance in two transactions without any other signatures.

An attacker with the Proposer role can unilaterally transfer all funds from the vulnerable multisig contract, resulting in a total loss of the contract's EGLD/ESDT assets. This compromises the fundamental security guarantees of the multisig system, allowing fund theft without the consensus or approval of other signatories.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict assignment of the Proposer role to fully trusted accounts only and consider disabling or limiting contract functionality that allows fund movement by the Proposer role alone.