CVE-2026-47197: Quest Bot Auth Bypass Vulnerability

CVE-2026-47197 Overview

CVE-2026-47197 is a missing authorization vulnerability [CWE-862] in Quest Bot, an open-source Discord moderation bot maintained by the duck-organization project. Versions prior to 1.1.6 fail to enforce Discord's role hierarchy when processing moderation commands. A moderator holding the relevant Discord permission bit can use the bot to act against users ranked above them in the role hierarchy, provided the bot itself outranks the target. The flaw enables lower-privileged moderators to ban, kick, timeout, untimeout, warn, or rename higher-ranked members, including server staff. The maintainers patched the issue in version 1.1.6.

Critical Impact
Lower-ranked moderators can bypass Discord's role hierarchy to take destructive moderation actions against higher-ranked users, including administrators.

Affected Products

Quest Bot (duck-organization/questbot) versions prior to 1.1.6
Discord servers running self-hosted instances of Quest Bot
Discord servers using shared deployments of Quest Bot pre-1.1.6

Discovery Timeline

2026-06-12 - CVE-2026-47197 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47197

Vulnerability Analysis

Quest Bot exposes moderation commands such as ban, kick, timeout, untimeout, warn, and rename through its Discord slash command interface. Discord's native moderation API enforces a role hierarchy check: a user cannot moderate another user whose highest role is positioned above their own. Quest Bot performs its moderation actions using the bot's own identity, not the invoking moderator's. The bot validates only that the caller holds the relevant Discord permission bit, such as BAN_MEMBERS or MODERATE_MEMBERS. It does not compare the caller's top role position to the target's top role position before executing the action.

Root Cause

The root cause is a missing authorization check [CWE-862] in the moderation command handlers. The bot trusts Discord permission bits as the sole authorization signal and skips the hierarchy comparison that Discord itself enforces for direct user-to-user moderation. Because the bot account typically sits high in the role hierarchy, its actions succeed against nearly any target. This effectively delegates the bot's elevated rank to any moderator who can invoke its commands.

Attack Vector

An attacker requires a Discord account on the target server with at least one moderation permission bit assigned, such as KICK_MEMBERS or MODERATE_MEMBERS. The attacker invokes a Quest Bot moderation command and targets a user ranked above them, for example an administrator or server owner delegate. The bot executes the action without performing a hierarchy comparison. The targeted user is banned, kicked, timed out, warned, or renamed despite outranking the attacker. No exploit code is required beyond standard Discord command usage, and no public proof-of-concept has been published.

The vulnerability is described in the GitHub Security Advisory GHSA-qw95-583r-hrwp.

Detection Methods for CVE-2026-47197

Indicators of Compromise

Audit log entries showing Quest Bot performing moderation actions where the invoking user's top role is below the target's top role.
Unexpected bans, kicks, timeouts, or nickname changes against administrators or senior moderators attributed to the Quest Bot account.
Quest Bot command invocations from low-privileged moderators targeting high-ranked members in short succession.

Detection Strategies

Review Discord server audit logs and filter for actions performed by the Quest Bot user, then cross-reference the invoking moderator's role position against the target's role position.
Compare the installed Quest Bot version against 1.1.6 using the bot's version command or by inspecting the deployment's release tag.
Enable Discord's built-in audit log retention and forward events to a centralized log store for hierarchy-aware analysis.

Monitoring Recommendations

Forward Discord audit log webhooks to a SIEM or log aggregation platform and alert on moderation actions by Quest Bot against users with elevated roles.
Track invocations of the bot's ban, kick, timeout, warn, and rename commands and correlate them with the caller's role position.
Establish a baseline of expected moderator activity and flag deviations such as junior moderators repeatedly targeting senior staff.

How to Mitigate CVE-2026-47197

Immediate Actions Required

Upgrade Quest Bot to version 1.1.6 or later on all self-hosted and shared deployments.
Audit recent Discord audit logs for moderation actions executed by Quest Bot and reverse any unauthorized bans, kicks, or timeouts.
Review and tighten which Discord roles hold moderation permission bits while patching is in progress.

Patch Information

The maintainers released the fix in Quest Bot v1.1.6. The patch adds a role hierarchy comparison so that the bot refuses to act when the invoking moderator's top role is not above the target's top role. Operators of self-hosted deployments must pull the new release and restart the bot process. Refer to the GitHub Security Advisory GHSA-qw95-583r-hrwp for advisory details.

Workarounds

Remove moderation permission bits from lower-tier roles until the upgrade to 1.1.6 is complete.
Lower the Quest Bot account's position in the role hierarchy so it cannot act against senior staff, accepting that legitimate moderation against high-ranked users will also be blocked.
Temporarily disable the Quest Bot integration or revoke its moderation permissions in the server settings until patched.

bash

# Upgrade self-hosted Quest Bot deployment to the patched release
git fetch --tags
git checkout questbot-v1.1.6
npm install --production
pm2 restart questbot