Quest Bot CVE-2026-47188

Exploitation requires the attacker to hold a Discord role that has been granted permission to use the /unban or /unwarn slash commands within the target guild - this is a non-default permission granted by server administrators, not available to regular members. The bot must be running a version prior to 1.0.5. The mass ping is constrained to the Discord guild where the vulnerable bot is active; it cannot affect users outside that guild. The key limiting factors are: (1) attacker must be a trusted moderator already granted elevated bot command access by server admins; (2) impact is a notification nuisance, not data exfiltration or code execution; (3) no unauthenticated or external attack path exists.

The CVSS 4.0 base score of 2.3 (Very Low) accurately reflects the constrained real-world impact. The vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L captures key facts: network-reachable but requiring low-privilege (moderator) access; the AT:P (Attack Requirements: Present) metric encodes that the attacker must already possess moderator permissions within the Discord guild, which are granted by server administrators rather than self-assignable. Confidentiality impact is none - no data is disclosed. Integrity and availability impacts are low, limited to unsolicited mass notification delivery (nuisance/disruption). No EPSS score is available in the provided data and no KEV listing exists, consistent with the low exploitability profile. There is no known public exploit code. The primary real-world threat model is a rogue or compromised moderator abusing existing elevated permissions, not an external unauthenticated attacker. The tag 'Information Disclosure' from the NVD appears misapplied - the actual impact is unauthorized notification delivery, not data exposure.

A Discord server moderator with legitimate access to the /unban and /unwarn commands crafts a reason string containing @everyone such as 'Ban lifted @everyone check pinned rules.' When the bot processes the command and posts the reason in a public channel, the Discord API parses the @everyone mention and delivers a notification to every member of the guild. No public exploit code exists for this vulnerability; the attack requires only knowledge of the flaw and existing moderator permissions.