CVE-2026-47197: CWE-862: Missing Authorization in duck-organization questbot
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to moderate users above them in the Discord role hierarchy, as long as the bot itself outranks the target. This bypasses Discord’s normal role hierarchy protections and lets lower-ranked moderators ban, kick, timeout, untimeout, warn, or rename higher-ranked users. This issue has been patched in version 1.1.6.
AI Analysis
Technical Summary
CVE-2026-47197 is a missing authorization vulnerability (CWE-862) in the duck-organization's Quest Bot for Discord. Before version 1.1.6, the bot allowed moderators with relevant Discord permission bits to moderate users above their rank in the Discord role hierarchy, provided the bot itself outranked the target user. This bypasses Discord's intended role hierarchy protections, enabling unauthorized moderation actions such as banning, kicking, timing out, un-timing out, warning, or renaming higher-ranked users. The issue was fixed in Quest Bot version 1.1.6.
Potential Impact
Exploitation of this vulnerability allows a lower-ranked moderator to perform moderation actions on higher-ranked users, violating Discord's role hierarchy security model. This can lead to unauthorized bans, kicks, timeouts, warnings, or renaming of privileged users, potentially disrupting server management and trust.
Mitigation Recommendations
Upgrade Quest Bot to version 1.1.6 or later, where this authorization bypass vulnerability has been patched. No other mitigations are indicated by the vendor advisory.
CVE-2026-47197: CWE-862: Missing Authorization in duck-organization questbot
Description
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to moderate users above them in the Discord role hierarchy, as long as the bot itself outranks the target. This bypasses Discord’s normal role hierarchy protections and lets lower-ranked moderators ban, kick, timeout, untimeout, warn, or rename higher-ranked users. This issue has been patched in version 1.1.6.
CVSS v4.0
Score 7.2high
Affected software
pkg:github/duck-organization/questbotRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-47197 is a missing authorization vulnerability (CWE-862) in the duck-organization's Quest Bot for Discord. Before version 1.1.6, the bot allowed moderators with relevant Discord permission bits to moderate users above their rank in the Discord role hierarchy, provided the bot itself outranked the target user. This bypasses Discord's intended role hierarchy protections, enabling unauthorized moderation actions such as banning, kicking, timing out, un-timing out, warning, or renaming higher-ranked users. The issue was fixed in Quest Bot version 1.1.6.
Potential Impact
Exploitation of this vulnerability allows a lower-ranked moderator to perform moderation actions on higher-ranked users, violating Discord's role hierarchy security model. This can lead to unauthorized bans, kicks, timeouts, warnings, or renaming of privileged users, potentially disrupting server management and trust.
Mitigation Recommendations
Upgrade Quest Bot to version 1.1.6 or later, where this authorization bypass vulnerability has been patched. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-18T22:07:37.435Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2bfa79e617e2d83469ab1a
Added to database: 06/12/2026, 12:24:25 UTC
Last enriched: 06/19/2026, 18:24:50 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 95
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.