Quest Bot EUVD-2026-36274

The bot must have been explicitly granted Discord's 'Mention Everyone' permission in the target server - this is an elevated permission not enabled by default in Discord's bot permission model, and without it Discord ignores @everyone and @here in bot-authored messages, fully neutralizing the attack. Any server member with access to the ticket creation command qualifies as an attacker; no elevated role or authentication beyond standard Discord server membership is required (PR:N per CVSS). Exploitation is further limited to Quest Bot versions strictly below 1.0.3. The attack does not work against deployments where 'Mention Everyone' was withheld from the bot, against servers that restrict ticket creation to trusted roles, or against patched instances running version 1.0.3 or later.

The CVSS 4.0 score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N) reflects a medium-severity network-exploitable flaw with no privilege requirement. The AT:P (Attack Target Present) metric is the critical limiting factor: the bot must have been explicitly granted the 'Mention Everyone' Discord permission, which is an elevated, non-default configuration. Without this permission, Discord silently suppresses @everyone and @here in bot messages, rendering the attack ineffective. The impact is bounded to low integrity disruption (VI:L) and low availability disruption (VA:L) - unwanted notification spam - with no confidentiality impact, consistent with the VC:N rating. No EPSS score was provided in the intelligence data, so probabilistic exploitation estimates cannot be made. The vulnerability is absent from CISA KEV and has no known public exploit code, indicating no confirmed active exploitation. Real-world risk is therefore conditional: deployments where Quest Bot was never granted mention permissions are not meaningfully exposed, while those that did grant it face a low-barrier social-engineering or harassment vector. The 'Information Disclosure' tag in the source intelligence appears to be a misclassification - the actual impact is notification abuse, not data leakage.

A regular Discord server member opens a support ticket and submits '@everyone Bug report' as the ticket reason. Quest Bot, holding the 'Mention Everyone' permission, posts the verbatim reason text into the newly created ticket channel, triggering a mass notification to every user in the server. No exploit tooling or prior privileges are required; the attack requires only a Discord account, server membership, and awareness of the ticket creation command.