Executive brief
Quest Bot is an open-source tool used to manage and moderate Discord communities. A security flaw allows lower-level moderators to bypass Discord's standard safety rules and perform restricted actions—such as banning, kicking, or renaming—on higher-ranking administrators. This could lead to unauthorized account actions and significant disruption of community management.
Technical details
Quest Bot prior to version 1.1.6 fails to implement invoker-versus-target hierarchy checks in its moderation commands. While the bot correctly verifies if the invoking user has the necessary permission bits (e.g., BanMembers), it only checks if the bot itself outranks the target (using properties like 'targetMember.bannable') rather than comparing the invoker's role position to the target's role position. This allows a user with a lower-ranked moderator role to ban, kick, timeout, or rename users with higher-ranked roles (such as Administrators) if the bot's role is positioned at the top of the hierarchy. The issue is fixed in version 1.1.6 by adding role position comparisons.
Affected products
- duck-organization Quest Bot < 1.1.6
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published by maintainers
- 2026-05-21: patched: Version 1.1.6 released
- 2026-06-12: disclosed: CVE published to NVD