CVE-2026-47163— Quest Bot: Unprivileged users can create and remove AutoMod rules.
Quick assessment
Affected
duck-organization quest-bot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Quest Bot是Duck Organization开源的一款多功能Discord社区管理机器人。 Quest Bot 1.0.1之前版本存在安全漏洞，该漏洞源于/automod add、/automod remove和/automod list命令没有Discord默认权限要求且没有运行时版主权限检查，可能导致任何可以调用斜杠命令的公会成员添加规则匹配常见文本并删除其他用户的消息。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access TokenAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| duck-organization | quest-bot | < 1.0.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-47163
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Quest Bot: Unprivileged users can create and remove AutoMod rules.
Source: CVE Program / CVE List V5
Vulnerability Description
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.1, any guild member who can invoke slash commands can use /automod add, /automod remove, and /automod list because the command has no Discord default permission requirement and no runtime moderator permission check. An attacker can add a rule matching common text and make the bot delete other users’ messages. This issue has been patched in version 1.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Quest Bot 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Quest Bot是Duck Organization开源的一款多功能Discord社区管理机器人。 Quest Bot 1.0.1之前版本存在安全漏洞，该漏洞源于/automod add、/automod remove和/automod list命令没有Discord默认权限要求且没有运行时版主权限检查，可能导致任何可以调用斜杠命令的公会成员添加规则匹配常见文本并删除其他用户的消息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| duck-organization | quest-bot | < 1.0.1 | - |
|
II. Public POCs for CVE-2026-47163
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47163
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47163 (1)
Vendor Pages for CVE-2026-47163 (1)
-
🔗 Release questbot-v1.0.1 · duck-organization/questbot · GitHub x_refsource_MISC
Same Patch Batch · duck-organization · 2026-06-11 · 11 CVEs total
| CVE-2026-47188 | Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions. | |
| CVE-2026-47189 | Quest Bot: AutoMod removal can delete rules from another guild by global rule ID | |
| CVE-2026-47175 | Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings | |
| CVE-2026-47177 | Quest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility c | |
| CVE-2026-47173 | Quest Bot: Ticket reason allows mass-mention injection | |
| CVE-2026-47174 | Duck Site: Untrusted pull request code can trigger privileged production deployment | |
| CVE-2026-47176 | Quest Bot: Logging module can disclose private-channel message contents to a lower-visibil | |
| CVE-2026-47171 | Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here` | |
| CVE-2026-47172 | Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_r | |
| CVE-2026-47169 | Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled |
IV. Related Vulnerabilities
Same product: quest-bot
-
CVE-2026-47189
Quest Bot: AutoMod removal can delete rules from another gui -
CVE-2026-47188
Quest Bot: Unban and unwarn reason fields still allow bot-po -
CVE-2026-47177
Quest Bot: Ticket transcripts can disclose private ticket co -
CVE-2026-47176
Quest Bot: Logging module can disclose private-channel messa -
CVE-2026-47175
Quest Bot: Moderation reason fields allow bot-powered `@ever
Same vendor: duck-organization
-
CVE-2026-49347
Quest Bot: Ticket creation has no per-user open-ticket limit -
CVE-2026-48485
Quest Bot: Stored warn reasons can still trigger bot-powered -
CVE-2026-47197
Quest Bot: Discord moderation role hierarchy bypass in ban, -
CVE-2026-47195
Quest Bot: Per-channel permission overwrite bypass in purge -
CVE-2026-47196
Quest Bot: Empty automod rule causes every guild message to
Same weakness: CWE-862
-
CVE-2026-105421
WordPress Kit (formerly ConvertKit) for WooCommerce plugin < -
CVE-2026-39783
WordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure -
CVE-2026-103684
WordPress WP Event Solution plugin <= 4.1.25 - Broken Access -
CVE-2026-94669
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Br -
CVE-2026-39763
WordPress WP Dummy Content Generator plugin <= 4.0.0 - Broke
V. Comments for CVE-2026-47163
No comments yet