Executive Summary

The vulnerability CVE-2026-47195 affects the Quest Bot, an open-source Discord bot, specifically versions 1.1.5 and earlier.

The issue is that the bot's purge and slowmode commands only check guild-level permissions of the user invoking the command, rather than their effective channel-level permissions.

This means that a user who is denied moderation permissions in a specific channel can still delete messages or change slowmode settings in that channel through the bot, bypassing intended restrictions.

The root cause is that the bot uses member.permissions.has() to check permissions at the guild level instead of verifying the user's effective permissions in the specific channel.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized users to delete messages or change slowmode settings in Discord channels where they should not have such permissions.

As a result, moderation controls intended to restrict certain users at the channel level can be bypassed, potentially leading to misuse such as unauthorized message deletion or disruption of channel communication flow.

The severity of this issue is rated as High with a CVSS score of 7.1, indicating significant potential for misuse.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the QuestBot improperly checking only guild-level permissions instead of effective channel-level permissions for the purge and slowmode commands.

To detect this vulnerability, you can verify the version of QuestBot running in your environment. Versions 1.1.5 and earlier are affected, while version 1.1.6 and later have the fix.

There are no specific network or system commands provided to detect the vulnerability directly, but you can check the bot version with commands or queries relevant to your Discord bot management setup.

• Check the QuestBot version by reviewing the bot's status or configuration in your Discord server or bot management interface.
• Monitor usage of the purge and slowmode commands in channels where users have restricted channel-level permissions but broad guild-level permissions, to identify unauthorized actions.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade QuestBot to version 1.1.6 or later, where the vulnerability has been patched.

Until the upgrade can be applied, consider restricting the use of the purge and slowmode commands to trusted users who have appropriate channel-level permissions.

Additionally, review and adjust Discord permissions to minimize the risk of misuse by limiting guild-level permissions for users who should not have moderation capabilities in specific channels.

Useful 0 Not Useful 0