CVE-2026-47169 describes an incorrect privilege assignment vulnerability (CWE-266) in the open-source Discord moderation bot 'quest-bot' by duck-organization. Before version 1.0.3, users with Manage Server permissions could exploit the AutoRole configuration to assign roles with Administrator privileges to new members, despite lacking Manage Roles or Administrator permissions themselves. This occurs if the targeted role is below the bot's highest role, enabling privilege escalation to full server administrator upon joining with a controlled account. The vulnerability is patched in version 1.0.3.

An attacker with Manage Server permissions but without Manage Roles or Administrator can escalate privileges by assigning themselves an Administrator role via the bot's AutoRole feature. This leads to full server administrative control, potentially compromising server security and management.

Upgrade quest-bot to version 1.0.3 or later, where this privilege assignment vulnerability has been patched. No other mitigation actions are indicated.