CVE-2026-47197 Details
Description
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to moderate users above them in the Discord role hierarchy, as long as the bot itself outranks the target. This bypasses Discord’s normal role hierarchy protections and lets lower-ranked moderators ban, kick, timeout, untimeout, warn, or rename higher-ranked users. This issue has been patched in version 1.1.6.
A vulnerability in Quest Bot, an open-source Discord bot, allows lower-ranked moderators to misuse moderation commands on higher-ranked users, bypassing Discord's role hierarchy protections. This issue is present in versions through 1.1.5. The vulnerability arises because the bot's moderation commands only verify if the user has the necessary permissions, without checking the relative ranks of the users involved. As a result, moderators can ban, kick, mute, unmute, warn, or rename users who should be protected by the hierarchy, as long as the bot itself has a higher role.
Users are advised to update to Quest Bot version 1.1.6, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/duck-organization/questbot/security/advisories/GHSA-qw95-583r-hrwp | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.6 | [email protected] | Release NotesVendor |
| https://github.com/duck-organization/questbot/security/advisories/GHSA-qw95-583r-hrwp | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Duck-Organization Quest Bot | <= 1.1.5 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 13, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |