Quest Bot EUVD-2026-36414

Exploitation requires (1) the target Discord server to have Quest Bot prior to 1.1.6 installed, (2) the attacker to already be a member of that server with at least one Discord moderation permission bit recognised by the bot (Ban Members, Kick Members, Moderate Members, or Manage Nicknames depending on the action), and (3) Quest Bot's own role to be ranked above the victim in the server's role hierarchy. Exploitation is limited to actions Quest Bot exposes (ban, kick, timeout, untimeout, warn, rename) and cannot escalate beyond the bot's own role ceiling; servers that place Quest Bot below administrator/owner roles, or that do not grant moderation permission bits to lower-trust roles, are not exploitable.

The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:H (base 7.2) captures the situation well: network-reachable via Discord, low complexity, low privileges (any moderator with the relevant permission bit), no user interaction, and high integrity impact on the guild and subsequent system (Discord server membership/state). There is no EPSS score, no SSVC decision, and no entry in CISA KEV provided, and no public exploit identified at time of analysis, so this should be treated as a logic flaw whose exploitation requires existing moderator status on a server running a vulnerable Quest Bot instance - meaningful but not internet-wide. The Attack Requirement AT:P (a specific configuration - the bot must outrank the target and the invoker must already hold a Discord moderation permission) limits blast radius; conversely, on servers where Quest Bot is deployed near the top of the role list, a single compromised or rogue junior moderator can act against admins/owners, which is a material trust-boundary violation.

A junior moderator on a Discord server that uses Quest Bot - for example, someone with only the Moderate Members permission - invokes a Quest Bot command such as ban, kick, timeout, or rename targeting an administrator or the server owner. Because the bot's role sits above the target and Quest Bot only checks the invoker's permission bit (not their relative role rank), the action succeeds, letting the lower-ranked moderator silence, expel, or impersonate higher-ranked staff. No public exploit identified at time of analysis, but the abuse path is a single chat command and requires no tooling beyond existing moderator access.