CVE-2026-47195

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the invoking member. They do not check the member’s effective permissions in the channel where the command is run. A user denied channel-level moderation permissions can still delete messages or change slowmode through the bot. This issue has been patched in version 1.1.6.

CVSS

No CVSS.

References

Link	Resource
https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.6
https://github.com/duck-organization/questbot/security/advisories/GHSA-2wf8-554w-hrj9
https://github.com/duck-organization/questbot/security/advisories/GHSA-2wf8-554w-hrj9

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Quest Bot es un bot de Discord de código abierto. Antes de la versión 1.1.6, los comandos purge y slowmode solo verifican los permisos a nivel de gremio en el miembro invocador. No verifican los permisos efectivos del miembro en el canal donde se ejecuta el comando. Un usuario al que se le denegaron los permisos de moderación a nivel de canal aún puede eliminar mensajes o cambiar el slowmode a través del bot. Este problema ha sido parcheado en la versión 1.1.6.

Information

Published : 2026-06-12 13:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-47195

Mitre link : CVE-2026-47195

CVE.ORG link : CVE-2026-47195

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-47195", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47195", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T12:25:56.524743Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "duck-organization", "product": "questbot", "versions": [{"status": "affected", "version": "< 1.1.6"}]}]}], "published": "2026-06-12T13:16:32.930", "references": [{"url": "https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-2wf8-554w-hrj9", "source": "security-advisories@github.com"}, {"url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-2wf8-554w-hrj9", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the invoking member. They do not check the member\u2019s effective permissions in the channel where the command is run. A user denied channel-level moderation permissions can still delete messages or change slowmode through the bot. This issue has been patched in version 1.1.6."}, {"lang": "es", "value": "Quest Bot es un bot de Discord de c\u00f3digo abierto. Antes de la versi\u00f3n 1.1.6, los comandos purge y slowmode solo verifican los permisos a nivel de gremio en el miembro invocador. No verifican los permisos efectivos del miembro en el canal donde se ejecuta el comando. Un usuario al que se le denegaron los permisos de moderaci\u00f3n a nivel de canal a\u00fan puede eliminar mensajes o cambiar el slowmode a trav\u00e9s del bot. Este problema ha sido parcheado en la versi\u00f3n 1.1.6."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}