# CVE-2026-47175: Quest Bot unauthorized mass mentions in moderation commands

Source: https://junglewise.ai/threats/cve-2026-47175-quest-bot-unauthorized-mass-mentions-in-moderation-commands  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-47175 · Severity: info · CVSS 2.3 · Published 2026-06-11

Quest Bot is an open-source Discord bot used for server moderation and support. A flaw in how the bot handles moderation commands allows low-level moderators to trick the bot into sending mass notifications (like @everyone) that they would otherwise not have permission to send. This can be used to disrupt large servers and cause unwanted notification spam that appears to come from a trusted source.

Technologies: [Duck-Organization Quest Bot](https://junglewise.ai/threats/technologies/quest-bot). Vendors: [Duck-Organization](https://junglewise.ai/threats/vendors/duck-organization).

## Quick answers

**Is CVE-2026-47175 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47175 being exploited in the wild.

**How severe is CVE-2026-47175?** Informational severity, with a CVSS score of 2.3, published 11 June 2026.

**Which products and versions are affected?** Duck-Organization Quest Bot < 1.0.4.

**Is there a fix for CVE-2026-47175?** A patch was published on 2026-05-17: Version 1.0.4 released to fix mention parsing. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47175 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47175?** Check whether you run Duck-Organization Quest Bot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Quest Bot prior to version 1.0.4 is vulnerable to improper output escaping (CWE-116) within its moderation commands, including /ban, /kick, and /mute. The bot echoes user-provided 'reason' text in public confirmation messages without suppressing Discord mentions. An attacker with basic moderation privileges but lacking 'Mention Everyone' permissions can include @everyone or @here in the reason field. Because the bot itself typically possesses high-level permissions, Discord parses these strings as valid mass-mentions, allowing the attacker to bypass intended permission restrictions. The issue is present even if the moderation action is canceled, as the confirmation message is sent immediately.

## Affected products

- duck-organization Quest Bot < 1.0.4

## Timeline

- 2026-05-17: patched: Version 1.0.4 released to fix mention parsing.
- 2026-06-11: disclosed: CVE-2026-47175 published.

## References

- [https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.4](https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.4)
- [https://github.com/duck-organization/questbot/security/advisories/GHSA-556x-7wgq-25fp](https://github.com/duck-organization/questbot/security/advisories/GHSA-556x-7wgq-25fp)

## Related threats

- [duck-organization Quest Bot resource exhaustion via ticket creation](https://junglewise.ai/threats/cve-2026-49347-duck-organization-quest-bot-resource-exhaustion-via-ticket)
- [Quest Bot improper output escaping in /warns command](https://junglewise.ai/threats/cve-2026-48485-quest-bot-improper-output-escaping-in-warns-command)
- [Quest Bot Discord role hierarchy bypass in moderation commands](https://junglewise.ai/threats/cve-2026-47197-quest-bot-discord-role-hierarchy-bypass-in-moderation-commands)
- [Quest Bot improper input validation in automod command](https://junglewise.ai/threats/cve-2026-47196-quest-bot-improper-input-validation-in-automod-command)
- [Quest Bot incorrect authorization in purge and slowmode commands](https://junglewise.ai/threats/cve-2026-47195-quest-bot-incorrect-authorization-in-purge-and-slowmode-commands)