What’s Vulnerable › Vulnerabilities

CVE-2022-39302: Ree6 may bypass webhook protection

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-14 · updated 2026-06-17
• Weakness: CWE-863

Description

Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel and bypass raid and webhook protections. A specifically crafted log message could allow spamming and mass advertisements. This issue has been patched in version 1.9.9. There are currently no known workarounds.

Affected products

• Ree6-Applications Ree6: before 1.9.9 — fixed in 1.9.9

How to fix

Upgrade to a fixed version: Ree6-Applications Ree6 1.9.9. Check the vendor advisory for mitigations.

References

• https://github.com/Ree6-Applications/Ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a
• https://github.com/Ree6-Applications/Ree6/security/advisories/GHSA-v574-xgcf-5w8x
• https://github.com/Ree6-Applications/Ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a
• https://github.com/Ree6-Applications/Ree6/security/advisories/GHSA-v574-xgcf-5w8x

Get alerted when CVE-2022-39302 or the next vulnerability affects your stack