CVE-2026-47195 HIGH

CVE-2026-47195: Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands.

Vendor Duck-Organization
Product questbot
Weakness CWE-863 · Incorrect authorization
Published June 12, 2026
Last update June 12, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

What the vulnerability does

01Description

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the invoking member. They do not check the member’s effective permissions in the channel where the command is run. A user denied channel-level moderation permissions can still delete messages or change slowmode through the bot. This issue has been patched in version 1.1.6.

Key dates

02Disclosure timeline

June 12, 2026 CVE published
June 12, 2026 Record updated