Is CVE-2026-47175 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47175 being exploited in the wild.

How severe is CVE-2026-47175?

Informational severity, with a CVSS score of 2.3, published 11 June 2026.

Which products and versions are affected?

Duck-Organization Quest Bot < 1.0.4.

Is there a fix for CVE-2026-47175?

A patch was published on 2026-05-17: Version 1.0.4 released to fix mention parsing. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47175 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47175?

Check whether you run Duck-Organization Quest Bot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47175: Quest Bot unauthorized mass mentions in moderation commands

Q: Is there a fix for CVE-2026-47175?

A patch was published on 2026-05-17: Version 1.0.4 released to fix mention parsing. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47175 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-47175?

Check whether you run Duck-Organization Quest Bot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47175 · Severity: info · CVSS 2.3 · Published 2026-06-11

Quest Bot is an open-source Discord bot used for server moderation and support. A flaw in how the bot handles moderation commands allows low-level moderators to trick the bot into sending mass notifications (like @everyone) that they would otherwise not have permission to send. This can be used to disrupt large servers and cause unwanted notification spam that appears to come from a trusted source.

Technologies: Duck-Organization Quest Bot. Vendors: Duck-Organization.

Quick answers

Is CVE-2026-47175 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47175 being exploited in the wild.
How severe is CVE-2026-47175?: Informational severity, with a CVSS score of 2.3, published 11 June 2026.
Which products and versions are affected?: Duck-Organization Quest Bot < 1.0.4.
Is there a fix for CVE-2026-47175?: A patch was published on 2026-05-17: Version 1.0.4 released to fix mention parsing. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47175 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47175?: Check whether you run Duck-Organization Quest Bot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Quest Bot prior to version 1.0.4 is vulnerable to improper output escaping (CWE-116) within its moderation commands, including /ban, /kick, and /mute. The bot echoes user-provided 'reason' text in public confirmation messages without suppressing Discord mentions. An attacker with basic moderation privileges but lacking 'Mention Everyone' permissions can include @everyone or @here in the reason field. Because the bot itself typically possesses high-level permissions, Discord parses these strings as valid mass-mentions, allowing the attacker to bypass intended permission restrictions. The issue is present even if the moderation action is canceled, as the confirmation message is sent immediately.

Affected products

duck-organization Quest Bot < 1.0.4

Timeline

2026-05-17: patched: Version 1.0.4 released to fix mention parsing.
2026-06-11: disclosed: CVE-2026-47175 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.