Quest Bot EUVD-2026-36275

Exploitation requires the invoking user to hold a Discord role that grants access to Quest Bot's moderation commands (e.g., ban, kick, warn) but explicitly lacks the 'Mention @everyone, @here, and All Roles' Discord permission. Simultaneously, the bot's own role must possess that mention permission in the target guild or channel. Without both conditions - moderator command access combined with a permission asymmetry between the user and the bot - no privilege escalation occurs. General server members without moderation command access cannot trigger this. The vulnerability does not apply in guilds where the bot has been denied @everyone permission at the role or channel level.

The CVSS 4.0 base score of 2.3 accurately reflects the narrow real-world impact: VI:L and VA:L with no confidentiality impact (VC:N, SC:N/SI:N/SA:N). AT:P flags the attack requirement that the bot must possess mention-everyone permission while the invoking moderator does not - both conditions must be simultaneously true, which is a common but not universal configuration. PR:L confirms a moderator-level account (not a general member) is required, limiting the attacker pool. There is no CISA KEV listing and no EPSS data provided, and no public proof-of-concept exists at time of analysis. This is a genuine but low-severity privilege escalation within the Discord permission hierarchy - real harm is limited to unwanted mass notification spam. It is not a remote code execution or data exposure issue, and the CVSS score is an appropriate signal: this should be patched but is not an emergency for most server operators.

A moderator in a Discord server types a ban or warn command with a reason field containing '@everyone Server is being reset, click this link' - the bot, which holds the @everyone mention permission, echoes the full reason text in a public channel reply with mention parsing active, triggering a server-wide notification the moderator could not have sent directly. No exploit tool is required; standard Discord slash command or prefix-command interaction suffices.