EUVD-2026-36414Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploited over Discord (AV:N) by any moderator with a permission bit (PR:L), no user interaction, scope changes to the Discord guild (S:C); primary impact is integrity of higher-ranked accounts (I:H) with some availability loss via bans/timeouts (A:L) and no data disclosure.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to moderate users above them in the Discord role hierarchy, as long as the bot itself outranks the target. This bypasses Discord’s normal role hierarchy protections and lets lower-ranked moderators ban, kick, timeout, untimeout, warn, or rename higher-ranked users. This issue has been patched in version 1.1.6.
AnalysisAI
Discord role hierarchy bypass in Quest Bot (open-source Discord moderation bot) prior to version 1.1.6 allows moderators to perform privileged actions against users ranked above them in the server role hierarchy. Any moderator holding the relevant Discord permission bit can ban, kick, timeout, untimeout, warn, or rename higher-ranked members so long as the bot itself outranks the target. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Quest Bot is an open-source Discord bot (CPE cpe:2.3:a:duck-organization:questbot) that executes moderation commands on behalf of users via the Discord API. Discord normally enforces a role hierarchy in which a member cannot moderate another member whose highest role is equal to or above their own. The root cause is CWE-862 (Missing Authorization): Quest Bot only verified that the invoking user held the Discord permission bit for the action and that the bot's role outranked the target, but never compared the invoker's top role against the target's top role. Because the bot acts with its own (higher) role, this effectively launders the moderator's request through a more privileged identity, defeating Discord's client- and API-side hierarchy checks.
RemediationAI
Vendor-released patch: questbot-v1.1.6 - operators of Quest Bot should upgrade to 1.1.6 or later per the release at https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.6 and the advisory at https://github.com/duck-organization/questbot/security/advisories/GHSA-qw95-583r-hrwp. Until the upgrade is deployed, the most effective compensating controls are to lower Quest Bot's role beneath the roles you want to protect (so it cannot act on admins/owners at all - trade-off: it can no longer moderate equally high-ranked offenders), revoke Discord moderation permission bits (Ban Members, Kick Members, Moderate Members, Manage Nicknames) from lower-trust moderator roles, or temporarily remove/disable the bot in sensitive servers. Audit recent moderation actions (ban/kick/timeout/warn/rename) issued through Quest Bot against high-ranked accounts to detect prior abuse before patching.
Improper input validation in Quest Bot (an open-source Discord bot) prior to version 1.1.6 lets a guild moderator weapon
Authorization bypass in Quest Bot Discord bot prior to version 1.1.6 lets low-privilege guild members invoke the purge a
Ticket panel resource exhaustion in Quest Bot (open-source Discord bot, all versions prior to 1.1.8) allows any Discord
Mention injection in Quest Bot prior to version 1.1.6 allows Discord server moderators to embed @everyone or @here mass-
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today