CVE-2026-47195: Quest Bot incorrect authorization in purge and slowmode commands

CVE-2026-47195 · Severity: info · CVSS 7.1 · Published 2026-06-12

Quest Bot is an open-source tool used to manage and moderate Discord communities. A security flaw allows users who have general server permissions to bypass specific restrictions set for individual channels. This means an unauthorized user could delete messages or change chat speed settings in protected channels where they should not have access, potentially disrupting community operations or removing evidence of misconduct.

Technologies: Duck-Organization Quest Bot. Vendors: Duck-Organization.

Quick answers

Is CVE-2026-47195 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47195 being exploited in the wild.
How severe is CVE-2026-47195?
Informational severity, with a CVSS score of 7.1, published 12 June 2026.
Which products and versions are affected?
Duck-Organization Quest Bot <= 1.1.5.
Is there a fix for CVE-2026-47195?
A patch was published on 2026-05-21: Version 1.1.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47195 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47195?
Check whether you run Duck-Organization Quest Bot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Quest Bot (prior to v1.1.6) contains an incorrect authorization vulnerability in its moderation commands. The 'purge' and 'slowmode' commands utilize 'member.permissions.has()', which only evaluates guild-level permissions and ignores Discord's channel-specific permission overwrites. An attacker with guild-level 'Manage Messages' or 'Manage Channels' permissions can execute these commands in channels where they have been explicitly denied those rights via channel overwrites. This allows for unauthorized message deletion (bulkDelete) and modification of channel rate limits (setRateLimitPerUser). The issue is resolved in version 1.1.6 by implementing effective permission checks that account for the specific channel context.

Affected products

  • duck-organization Quest Bot <= 1.1.5

Timeline

  • 2026-05-18: advisory: GitHub Security Advisory published
  • 2026-05-21: patched: Version 1.1.6 released
  • 2026-06-12: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.