What is the CVSS score of EUVD-2026-36299?

EUVD-2026-36299 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-36299?

Within 24 hours: Inventory all Discord servers running Quest Bot and verify if the bot holds the 'Mention Everyone' permission. Within 7 days: Implement interim mitigations by disabling the reminders feature, revoking 'Mention Everyone' permission, or restricting command access to trusted roles; monitor the Quest Bot project for version 1.0.3 as the vendor-identified fix. Within 30 days: Upgrade to Quest Bot 1.0.3 when released or migrate to an alternative moderation bot if remediation timelines are unacceptable.

Quest Bot EUVD-2026-36299

Q: Which versions of Quest Bot are affected by EUVD-2026-36299?

Quest Bot, an open-source Discord moderation utility, contains a privilege escalation vulnerability (CVSS 8.8) allowing unprivileged users to trigger server-wide @everyone and @here mentions through…. A patch is available.

| CVE-2026-47171 HIGH

Improper Encoding or Escaping of Output (CWE-116)

2026-06-11 GitHub_M

Information Disclosure Quest Bot Duck Organization

8.8

CVSS 4.0 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Join target Discord server with Quest Bot
Delivery

Invoke reminder command with @everyone payload
Exploit

Wait for scheduled trigger
Execution

Bot re-emits unsanitized text with Mention Everyone permission
Persist

Mass notification delivered to all members
Impact

Use ping for spam, distraction, or phishing pretext

Vulnerability Assessment

Weakness	CWE CWE-116 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding for downstream
Exploitation Conditions	Requires (1) a target Discord server running Quest Bot prior to version 1.0.3, (2) the bot account possessing the Mention Everyone permission at the server or channel level (otherwise Discord silently strips the mass mention), and (3) the attacker being any normal server member who can invoke the bot's reminder-create command - no Discord administrator, moderator, or bot-owner privileges are needed. Exploitation is limited where server admins have already removed Mention Everyone from the bot's role, where reminder commands are restricted by Discord's built-in command permissions to trusted roles, or where the bot is deployed only in small private servers with no @everyone audience to weaponize.
Impact	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) honestly reflects that any Discord user with reminder access can trigger the issue from anywhere with no special skill, and the VI:H rating maps to the integrity impact of the bot speaking attacker-controlled mass-ping messages. Real-world impact is bounded though - there is no data exfiltration (VC:N), no code execution, and exploitation is limited to nuisance/disruption (mass notifications, social-engineering pretexts) on servers that grant the bot Mention Everyone. No KEV listing, no published POC, and EPSS data was not provided; given the very small install base of this specific bot, real-world exploitation is likely opportunistic rather than mass-scanned. Treat as a moderate-priority hygiene fix for any server actually running Quest Bot, not an emergency for the broader ecosystem.
Exploit ScenarioDerived	A non-privileged member of a Discord server invokes Quest Bot's reminder command with a body like 'meeting time @everyone' scheduled a few minutes out, then leaves the channel or stays silent. When the timer fires, the bot - which holds Mention Everyone - re-emits the stored text, sending a real @everyone push notification to every member, enabling spam, distraction during an incident, or a pretext for follow-on phishing messages. No POC code is published, but reproduction requires only the documented reminder command.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 11, 2026

Mass mention abuse in Quest Bot (open-source Discord moderation/utility bot) before version 1.0.3 allows any normal Discord user to schedule reminders containing @everyone or @here payloads that the bot later re-sends without mention suppression. Because the bot typically holds the Mention Everyone permission, the stored reminder text effectively grants unprivileged users the ability to ping an entire server or channel on demand. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the trivial reproduction path makes the abuse pattern likely once known.

RemediationAI

Vendor-released patch: questbot-v1.0.3 - upgrade Quest Bot to 1.0.3 or later (release notes at https://github.com/duck-organization/questbot/releases/tag/questbot-v1.0.3, advisory at https://github.com/duck-organization/questbot/security/advisories/GHSA-vmgg-f3m4-6fcv). If immediate upgrade is not possible, revoke the bot's Mention Everyone permission in Discord server settings or per-channel overwrites, which fully neutralizes the abuse at the cost of breaking any legitimate announcement features the bot offers. As a narrower compensating control, restrict who can invoke the reminder command via Discord's command permissions or a role gate so untrusted members cannot schedule arbitrary reminder text; this preserves the feature but shifts trust to moderator roles.

Affected VersionsENISA

quest-bot < 1.0.3

Affected Packages

euvd quest_bot fix: 1.0.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Quest Bot is a Discord application (cpe:2.3:a:duck-organization:quest-bot) that stores user-supplied reminder text and rebroadcasts it through the bot identity at a later time. The root cause is CWE-116 (Improper Encoding or Escaping of Output): the reminder dispatcher echoes attacker-controlled content into a privileged channel context without sanitizing Discord's mention tokens (@everyone, @here, role pings) or setting the API's allowed_mentions flag to suppress mass mentions. Discord treats these tokens as mentions only when the sending account carries the Mention Everyone permission, so the bot's elevated privileges become the exploitation primitive rather than any memory-corruption or auth flaw.

Know when Quest Bot gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

vuln.today AI 5.0 MEDIUM

Attacker must be an authenticated Discord user with reminder access (PR:L), scope changes to the bot's privileged channel context (S:C), and impact is limited to integrity of channel messaging (I:L); no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

High

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 20:01 EUVD

DescriptionCVE.org

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When the reminder triggers, the bot sends the stored message back into the channel without suppressing mass mentions. If the bot has permission to mention everyone, the reminder can ping the entire server or channel later. This issue has been patched in version 1.0.3.

Executive ViewAI

Why It Matters

Quest Bot, an open-source Discord moderation utility, contains a privilege escalation vulnerability (CVSS 8.8) allowing unprivileged users to trigger server-wide @everyone and @here mentions through stored reminders. Although no public exploit is currently identified, the trivial attack pattern poses significant operational risk once disclosed. Organizations using Quest Bot should immediately implement mitigations to prevent potential abuse of Discord infrastructure.

Business Impact: High

Compensating Controls

Until vendor patch is released, implement the following: (1) Disable the reminders feature in Quest Bot configuration to eliminate the attack vector; (2) Revoke the 'Mention Everyone' permission from the bot's Discord role; (3) Restrict bot command access via role-based Discord permissions to limit unprivileged user interaction; (4) Enable Discord audit logging and establish alerts for reminder creation by non-administrative accounts; (5) Evaluate temporary replacement with an alternative moderation bot.

Threat Intelligence Overview

EPSS Score

0.0%

Top 87% exploitable

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.