What’s Vulnerable › Vulnerabilities

CVE-2026-47169: Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts

• Severity: high (CVSS 7.5 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-11 · updated 2026-10-26
• Weakness: CWE-266

Description

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a user with Manage Server / ManageGuild, but without Manage Roles or Administrator, can configure the bot’s AutoRole feature to assign an arbitrary role to new members. If the selected role has Administrator and is below the bot’s highest role, the attacker can join with a controlled account and receive full server admin. This issue has been patched in version 1.0.3.

Affected products

• duck-organization quest-bot: before 1.0.3

References

• https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.3
• https://github.com/duck-organization/questbot/security/advisories/GHSA-8vgg-4hpx-7qfg
• https://github.com/duck-organization/questbot/security/advisories/GHSA-8vgg-4hpx-7qfg

Get alerted when CVE-2026-47169 or the next vulnerability affects your stack