Quest Bot CVE-2026-47177

Exploitation requires the attacker to hold high-privilege access to configure Quest Bot settings (PR:H per CVSS 4.0 vector). The specific attack requirement (AT:P) is the ability to set the ticket transcript channel to a channel the attacker can read - this is an explicit configuration action, not a passive condition. Additionally, at least one ticket must be closed by any user after the malicious configuration is applied, supplying the passive user interaction (UI:P) that triggers the transcript export. The vulnerability does not affect previously closed tickets unless the bot re-exports them. Exploitation is bounded to Discord servers running Quest Bot prior to v1.0.4 with at least one active ticket lifecycle occurring post-misconfiguration. What limits exploitation: high privilege access to bot settings is required, a ticket close event must occur after misconfiguration, and the attacker must control or monitor the redirect channel.

The CVSS 4.0 score of 5.7 (Medium) is appropriate and reflects significant limiting factors: PR:H (attacker must have bot settings configuration privileges), AT:P (a specific attack requirement - the deliberate misconfiguration - must be set up in advance), and UI:P (a ticket must be closed by another user after the configuration change to trigger the transcript export). VC:H confirms that full ticket history is exposed when exploitation succeeds. This is not a remotely exploitable vulnerability by arbitrary or unauthenticated users; it requires an insider or a compromised administrator account. No EPSS data was provided, and no CISA KEV listing exists, indicating no known widespread or active exploitation. Real-world risk is most relevant in multi-administrator or community-run Discord servers where bot admin trust boundaries are loosely defined. In tightly controlled single-administrator servers the risk is minimal.

A Discord server co-administrator with bot settings access reconfigures the ticket transcript channel to a general-access channel or a private channel only they monitor. When any support ticket is subsequently closed by a moderator or the ticket creator, the bot automatically posts the full private conversation history to that redirect channel. The attacker then reads sensitive support disclosures, user reports, or private communications without having had access to the original ticket channel.