CVE-2026-47195 Overview
CVE-2026-47195 is an authorization flaw in Quest Bot, an open-source Discord bot maintained by the duck-organization project. Versions prior to 1.1.6 evaluate only guild-level permissions when handling the purge and slowmode commands. The bot does not verify the invoking member's effective permissions at the channel scope. A user denied channel-level moderation rights can still delete messages and modify slowmode settings through the bot. The issue is categorized under CWE-863: Incorrect Authorization and was remediated in release 1.1.6.
Critical Impact
Authenticated low-privilege Discord users can bypass channel-level moderation restrictions to delete messages and alter slowmode, undermining server moderation policies.
Affected Products
- Quest Bot (duck-organization/questbot) versions prior to 1.1.6
- Quest Bot purge command handler
- Quest Bot slowmode command handler
Discovery Timeline
- 2026-06-12 - CVE-2026-47195 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-47195
Vulnerability Analysis
The vulnerability resides in the permission checks for the purge and slowmode commands in Quest Bot. Discord's permission model is layered: a member holds guild-wide (server) permissions, but those permissions can be overridden per channel through allow and deny rules. The bot only inspects the guild-level permission set when authorizing the command invoker. Channel-specific overrides that deny MANAGE_MESSAGES or MANAGE_CHANNELS are ignored. The result is a privilege boundary violation where the bot acts on behalf of users who lack the effective permission to perform the action directly. Attackers can delete arbitrary messages in restricted channels or alter slowmode rates, disrupting moderation workflows and removing evidence of abuse.
Root Cause
The authorization logic compares the invoker's guild permissions against a required permission flag rather than computing the effective permission set in the target channel. Discord exposes channel overwrites through the API, and bots must resolve them per command to enforce least privilege. Quest Bot's command pipeline omitted this resolution for purge and slowmode, producing an [CWE-863] incorrect authorization condition.
Attack Vector
Exploitation requires a Discord account that is a member of a server running a vulnerable Quest Bot instance. The account must hold a role granting MANAGE_MESSAGES or MANAGE_CHANNELS at the guild level while being explicitly denied those rights in a specific channel. The attacker invokes /purge or /slowmode in the restricted channel, and the bot executes the command using its own elevated permissions. No exploit code is publicly available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-2wf8-554w-hrj9 for full technical detail.
Detection Methods for CVE-2026-47195
Indicators of Compromise
- Unexpected bulk message deletions in channels where moderation is otherwise restricted, attributed to the Quest Bot account in Discord audit logs.
- Changes to channel slowmode values originating from the Quest Bot with command invokers who lack channel-level MANAGE_CHANNELS permission.
- Quest Bot command logs showing successful purge or slowmode invocations by users whose channel overwrites deny those rights.
Detection Strategies
- Review the Discord server audit log for MESSAGE_DELETE_BULK and CHANNEL_UPDATE entries performed by the Quest Bot, cross-referencing the invoking user's effective channel permissions.
- Compare role-based channel overwrites against bot command history to flag executions that violate channel-level deny rules.
- Run the bot's installed version against the patched release tag questbot-v1.1.6 to confirm exposure.
Monitoring Recommendations
- Forward Discord audit log events and bot command logs to a centralized log store for correlation against role and channel overwrite changes.
- Alert on Quest Bot-initiated bulk deletions or slowmode changes in channels marked sensitive by your moderation policy.
- Track the duck-organization GitHub repository for new advisories and version releases.
How to Mitigate CVE-2026-47195
Immediate Actions Required
- Upgrade Quest Bot to version 1.1.6 or later as published in the Quest Bot v1.1.6 release.
- Audit recent uses of /purge and /slowmode in your Discord server and identify any executions performed by members denied channel-level moderation.
- Rotate or restrict roles that grant guild-level moderation to users who should only moderate specific channels.
Patch Information
The maintainers released a fix in Quest Bot 1.1.6. The patch adds channel-level effective permission checks before executing the purge and slowmode commands. Details are documented in GitHub Security Advisory GHSA-2wf8-554w-hrj9.
Workarounds
- Disable the purge and slowmode commands in the bot configuration until the upgrade to 1.1.6 is complete.
- Restrict the Quest Bot role's MANAGE_MESSAGES and MANAGE_CHANNELS permissions to a minimal set of channels using Discord channel overwrites.
- Limit which roles can invoke Quest Bot slash commands using Discord's built-in integration permission controls.
# Upgrade Quest Bot to the patched release
git fetch --tags
git checkout questbot-v1.1.6
npm install
pm2 restart questbot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
