CVE-2026-47176 Details
Description
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a user who can configure bot settings can enable logging and choose a logging channel they can read. The bot then logs deleted and edited message contents from every channel it can see, including private channels the configuring user cannot access. This issue has been patched in version 1.0.4.
A vulnerability in Quest Bot versions prior to 1.0.4 allows users with the ability to configure bot settings to inadvertently log private-channel message contents into a channel they can read. This occurs because the bot logs deleted and edited messages from all accessible channels, including private ones that the user cannot directly access. The issue arises from a lack of proper permission checks, enabling unauthorized visibility of private discussions, moderation notes, and other confidential server content.
Users can update to Quest Bot version 1.0.4 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 11, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/duck-organization/questbot/security/advisories/GHSA-fvvp-8g5q-hrc7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.4 | [email protected] | Release NotesVendor |
| https://github.com/duck-organization/questbot/security/advisories/GHSA-fvvp-8g5q-hrc7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| duck-organization Quest Bot | <= 1.0.4 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | New CVE Received | [email protected] |