Quest Bot EUVD-2026-36413

Requires (1) a Discord guild that has invited Quest Bot at a version prior to 1.1.6 and granted it Manage Messages / Manage Channels permissions, (2) the attacker being an authenticated member of that guild holding the relevant moderation permission at the guild level (PR:L), and (3) a channel-level permission override that denies the same permission to the attacker in the target channel - without such an override there is no authorization decision to bypass (this matches AT:P in the CVSS 4.0 vector). Exploitation is limited to the purge and slowmode commands and does not grant any permissions the attacker lacks at the guild level; servers that rely solely on guild-level role design (no channel overrides) are not meaningfully affected.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L, base 7.1) is consistent with the description: a network-reachable Discord bot, low attacker privileges (any guild member with baseline moderation role at guild scope), no user interaction, and integrity-focused impact (message deletion, slowmode tampering) rather than confidentiality. The AT:P (attack requirement: present) reflects that the target guild must actually use channel-level permission overrides to restrict the user - in a guild where no such overrides exist, there is nothing to bypass. There is no EPSS, KEV, or SSVC data in the input, and no public exploit identified at time of analysis; given the narrow target (specific Discord servers running this bot with carefully scoped channel overrides), real-world risk is moderate and largely limited to communities that depend on channel-level moderation isolation. The 'Authentication Bypass' tag in the input is slightly imprecise - this is authorization (CWE-863), not authentication - but does not change the assessment.

A guild administrator grants a junior moderator the Manage Messages permission at the guild level but adds a channel-level override denying that permission in a sensitive channel (e.g., #staff-announcements). The junior moderator invokes Quest Bot's purge command targeting that channel; the bot only checks the guild-level permission, sees it granted, and deletes messages on the user's behalf even though Discord itself would have refused the action if attempted directly. The same path works for the slowmode command to disrupt conversation pacing.