Executive brief
Quest Bot is an open-source tool used to manage and moderate Discord communities. A security flaw allows users who have general server permissions to bypass specific restrictions set for individual channels. This means an unauthorized user could delete messages or change chat speed settings in protected channels where they should not have access, potentially disrupting community operations or removing evidence of misconduct.
Technical details
Quest Bot (prior to v1.1.6) contains an incorrect authorization vulnerability in its moderation commands. The 'purge' and 'slowmode' commands utilize 'member.permissions.has()', which only evaluates guild-level permissions and ignores Discord's channel-specific permission overwrites. An attacker with guild-level 'Manage Messages' or 'Manage Channels' permissions can execute these commands in channels where they have been explicitly denied those rights via channel overwrites. This allows for unauthorized message deletion (bulkDelete) and modification of channel rate limits (setRateLimitPerUser). The issue is resolved in version 1.1.6 by implementing effective permission checks that account for the specific channel context.
Affected products
- duck-organization Quest Bot <= 1.1.5
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-05-21: patched: Version 1.1.6 released
- 2026-06-12: disclosed: CVE published to NVD