CVE-2026-47171 HIGH

CVE-2026-47171: Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`

Vendor Duck-Organization
Product quest-bot
Weakness CWE-116
Published June 11, 2026
Last update June 11, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When the reminder triggers, the bot sends the stored message back into the channel without suppressing mass mentions. If the bot has permission to mention everyone, the reminder can ping the entire server or channel later. This issue has been patched in version 1.0.3.

Key dates

02Disclosure timeline

June 11, 2026 CVE published
June 11, 2026 Record updated