Quest Bot CVE-2026-47163

Target guild must have invited Quest Bot at a version prior to 1.0.1 and granted it Manage Messages permission for the automod deletion effect to occur. The attacker must be a member of that guild with the baseline ability to invoke slash commands in at least one channel where Quest Bot's commands are available - no moderator role, no Discord administrator permission, and no authentication beyond standard Discord guild membership is required. The vulnerability is exposed by default because the /automod commands were registered without a default_member_permissions restriction and the handler performs no runtime permission check; no special configuration toggle needs to be enabled by the victim guild.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) accurately reflects high integrity and availability impact (rule tampering and mass message deletion) with low complexity and low privileges (any guild member). However, real-world risk is bounded: exploitation is scoped to a single Discord guild that has invited the bot and granted it message-management permissions, and impact is moderation-layer harassment rather than host compromise - there is no confidentiality loss and no escape from the bot's permission boundary. EPSS data was not provided and the CVE is not on CISA KEV, so this is unlikely to attract opportunistic mass exploitation, but targeted abuse by trolls in affected communities is realistic given the simplicity. Treat as a priority patch for any community currently running Quest Bot, but not an emergency for the broader ecosystem.

A low-privileged member of a Discord guild running Quest Bot < 1.0.1 invokes /automod add with a rule matching a common word like 'the' or 'a', causing the bot to automatically delete subsequent messages from other members containing that text. The attacker can additionally use /automod remove to wipe legitimate moderator rules, effectively disabling protections and disrupting the community without ever holding moderator role.