CVE-2026-47189: Quest Bot: AutoMod removal can delete rules from another guild by global rule ID

Severity: high (CVSS 8.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-11 · updated 2026-10-26
Weakness: CWE-639

Description

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the AutoMod remove flow looks up and deletes rules by global database ID without verifying that the rule belongs to the guild where the command is executed. A user can learn a victim guild’s AutoMod rule ID through autocomplete, then remove that rule from another guild where they have Manage Server. This issue has been patched in version 1.0.5.

Affected products

duck-organization quest-bot: before 1.0.5

References

https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.5
https://github.com/duck-organization/questbot/security/advisories/GHSA-6rv9-6p24-w955
https://github.com/duck-organization/questbot/security/advisories/GHSA-6rv9-6p24-w955

Get alerted when CVE-2026-47189 or the next vulnerability affects your stack