High 7.2Published Jun 11, 2026

CVE-2026-47163Quest Bot: Unprivileged users can create and remove AutoMod rules.

Updated under an hour ago (Oct 28, 2026, 1:23 AM ET)

Does this affect you?

It affects duck-organization quest-bot. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for duck-organization quest-bot

Exploited in the last 30 days

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.1, any guild member who can invoke slash commands can use /automod add, /automod remove, and /automod list because the command has no Discord default permission requirement and no runtime moderator permission check. An attacker can add a rule matching common text and make the bot delete other users’ messages. This issue has been patched in version 1.0.1.

CVSS: 7.2 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-862
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Jun 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

duck-organization quest-bot duck_organization:quest_bot (from the name)	before 1.0.1	CNA record

References

References

https://github.com/duck-organization/questbot/security/advisories/GHSA-rphh-4h68-qr3j	x-refsource-confirm
https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.1	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.