CVE-2026-49347 Overview
CVE-2026-49347 is a resource consumption vulnerability in Quest Bot, an open-source Discord bot maintained by the duck-organization project. Versions prior to 1.1.8 allow any user with access to the ticket panel to repeatedly create new ticket channels. The bot creates a new database ticket and Discord channel for every completed ticket modal submission. It does not check whether the same user already has an open ticket and does not apply a cooldown. The flaw is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].
Critical Impact
Authenticated Discord users can exhaust server channel capacity and bloat the bot database by repeatedly submitting ticket modals, degrading bot and guild availability.
Affected Products
- Quest Bot (duck-organization/questbot) versions prior to 1.1.8
- Discord guilds running self-hosted Quest Bot instances
- Quest Bot ticket panel feature
Discovery Timeline
- 2026-06-12 - CVE-2026-49347 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-49347
Vulnerability Analysis
Quest Bot exposes a ticket panel that allows guild members to open support tickets through a Discord modal. Upon submission, the handler creates a new Discord channel and a corresponding database record. The handler does not enforce a per-user open-ticket limit and does not throttle submissions. Any user who can interact with the panel can submit the modal in a loop. Each submission produces a new channel and database row.
Discord guilds have a hard cap of 500 channels. An attacker can exhaust this cap, preventing legitimate channel creation across the guild. The same loop inflates the bot's backing database with orphaned ticket records. Bot operators face cleanup work, storage costs, and potential rate-limit exhaustion against the Discord API.
The vulnerability is categorized as a business logic flaw with denial of service impact. It requires low privileges and no user interaction beyond standard guild membership.
Root Cause
The ticket creation flow lacks two controls. First, the handler does not query existing tickets to determine whether the requesting user already owns an open ticket. Second, the handler does not enforce a cooldown between submissions from the same user. Both checks are standard guardrails for resource-creating Discord interactions and are absent in versions before 1.1.8.
Attack Vector
An attacker who is a member of a guild running a vulnerable Quest Bot instance opens the ticket panel and repeatedly submits the ticket modal. Each submission produces a fresh channel and database entry. Automation through a self-bot or scripted interaction client accelerates the abuse. The attack requires only the same permissions granted to any standard ticket panel user.
No verified proof-of-concept code is published for this issue. Technical details are available in the GitHub Security Advisory GHSA-r56q-v363-367q.
Detection Methods for CVE-2026-49347
Indicators of Compromise
- Rapid creation of ticket channels attributed to a single Discord user ID within a short time window
- Database rows in the Quest Bot tickets table showing multiple open tickets for the same user_id
- Discord audit log entries showing channel creation events at unusually high frequency from the bot account
- Approach toward or breach of the 500-channel guild limit on guilds hosting Quest Bot
Detection Strategies
- Query the Quest Bot database for users holding more than one concurrent open ticket
- Alert on bursts of CHANNEL_CREATE events generated by the Quest Bot service account in Discord audit logs
- Track per-user ticket creation rate and flag accounts exceeding a sane baseline such as one ticket per hour
Monitoring Recommendations
- Forward Discord audit logs and bot application logs to a centralized logging or SIEM platform for correlation
- Instrument the ticket handler with metrics on tickets created per user per minute and alert on outliers
- Monitor guild channel count and database row growth in the tickets table for sudden spikes
How to Mitigate CVE-2026-49347
Immediate Actions Required
- Upgrade Quest Bot to version 1.1.8 or later, which adds the missing checks
- Audit the tickets table for users with multiple open tickets and close or merge duplicates
- Restrict ticket panel access through Discord role permissions until the patched version is deployed
Patch Information
The maintainers released the fix in Quest Bot v1.1.8. The patched release verifies whether the submitting user already has an open ticket and applies a cooldown to modal submissions. Refer to the GitHub Security Advisory GHSA-r56q-v363-367q for full advisory details.
Workarounds
- Limit ticket panel visibility to trusted roles using Discord channel permissions until upgrade is possible
- Implement an external rate limit on the bot host such as a reverse proxy or sidecar that throttles modal submissions per user
- Schedule a periodic job that deletes stale or duplicate open tickets to contain database and channel growth
# Configuration example
# Upgrade Quest Bot to the patched release
git fetch --tags
git checkout questbot-v1.1.8
npm install
pm2 restart questbot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
