CVE-2026-47195: fallo de gravedad alta en duck-organization questbot
Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands.
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.4%
probabilidad de explotación
0.4%top 71% de las CVE
explotación observada
noninguna fuente lo reporta
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the invoking member. They do not check the member’s effective permissions in the channel where the command is run. A user denied channel-level moderation permissions can still delete messages or change slowmode through the bot. This issue has been patched in version 1.1.6.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
Productos afectados
duck-organization · questbotCVEs relacionadas — duck-organization questbot
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-48485LOWQuest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.EPSS 0.4%CVE-2026-49347MEDIUMQuest Bot: Ticket creation has no per-user open-ticket limit or cooldownEPSS 0.4%CVE-2026-47196HIGHQuest Bot: Empty automod rule causes every guild message to be deletedEPSS 0.4%CVE-2026-47197HIGHQuest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commandsEPSS 0.4%