Is CVE-2026-47197 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47197 being exploited in the wild.

How severe is CVE-2026-47197?

Informational severity, with a CVSS score of 7.2, published 12 June 2026.

Which products and versions are affected?

Duck-Organization Quest Bot < 1.1.6.

Is there a fix for CVE-2026-47197?

A patch was published on 2026-05-21: Version 1.1.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47197 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47197?

Check whether you run Duck-Organization Quest Bot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47197: Quest Bot Discord role hierarchy bypass in moderation commands

Q: Is there a fix for CVE-2026-47197?

A patch was published on 2026-05-21: Version 1.1.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47197 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-47197?

Check whether you run Duck-Organization Quest Bot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47197 · Severity: info · CVSS 7.2 · Published 2026-06-12

Quest Bot is an open-source tool used to manage and moderate Discord communities. A security flaw allows lower-level moderators to bypass Discord's standard safety rules and perform restricted actions—such as banning, kicking, or renaming—on higher-ranking administrators. This could lead to unauthorized account actions and significant disruption of community management.

Technologies: Duck-Organization Quest Bot. Vendors: Duck-Organization.

Quick answers

Is CVE-2026-47197 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47197 being exploited in the wild.
How severe is CVE-2026-47197?: Informational severity, with a CVSS score of 7.2, published 12 June 2026.
Which products and versions are affected?: Duck-Organization Quest Bot < 1.1.6.
Is there a fix for CVE-2026-47197?: A patch was published on 2026-05-21: Version 1.1.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47197 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47197?: Check whether you run Duck-Organization Quest Bot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Quest Bot prior to version 1.1.6 fails to implement invoker-versus-target hierarchy checks in its moderation commands. While the bot correctly verifies if the invoking user has the necessary permission bits (e.g., BanMembers), it only checks if the bot itself outranks the target (using properties like 'targetMember.bannable') rather than comparing the invoker's role position to the target's role position. This allows a user with a lower-ranked moderator role to ban, kick, timeout, or rename users with higher-ranked roles (such as Administrators) if the bot's role is positioned at the top of the hierarchy. The issue is fixed in version 1.1.6 by adding role position comparisons.

Affected products

duck-organization Quest Bot < 1.1.6

Timeline

2026-05-18: advisory: GitHub Security Advisory published by maintainers
2026-05-21: patched: Version 1.1.6 released
2026-06-12: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.