Quest Bot CVE-2026-47176

Exploitation requires the attacker to hold bot configuration privileges on the Discord server - specifically the permission to modify Quest Bot settings, which is a high-privilege role (PR:H). The bot must also have 'View Channel' or equivalent read access to at least one private channel that the configuring user cannot directly access; if the configuring user already has access to all channels the bot can see, no information disclosure occurs. Exploitation is further gated on passive user interaction (UI:P): other guild members must actively send, edit, or delete messages in those private channels for the logging feature to capture and forward content. There is no exploitation path against default Discord server configurations where bot configuration access is held only by users with full channel visibility. The limiting factors - high privilege requirement, specific channel permission topology, and passive UI dependency - significantly constrain the realistic attacker population.

Real-world risk is moderate and highly context-dependent. The CVSS 4.0 base score of 5.7 reflects the high privilege requirement (PR:H) and the presence of specific attack requirements (AT:P), which correctly signals that exploitation is not indiscriminate. An attacker must already hold bot configuration privileges - a non-trivial precondition in most Discord server deployments. However, the confidentiality impact to the vulnerable system is rated High (VC:H), meaning a successful exploit fully exposes private channel message content, which can be severe in communities using private channels for sensitive discussions (e.g., staff coordination, legal matters, moderation deliberations). EPSS data is not provided, and this CVE is not listed in CISA KEV, consistent with targeted rather than mass exploitation. No POC code has been identified. The overall risk is elevated for large Discord communities with role-segregated channels and lax bot permission governance, but low for small servers with minimal sensitive private channel use.

A Discord server moderator who has been granted bot configuration access but not membership in a private staff-only channel enables the Quest Bot logging feature and points the log output to a public or semi-public channel they can read. Once configured, any message deleted or edited by staff members in the private channel is automatically forwarded by the bot to the logging channel, revealing confidential staff discussions to the moderator. No exploit code is required - the attack is entirely conducted through the bot's legitimate settings UI.