EUVD-2026-36416Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Discord membership on target server
-
DeliveryGain ticket panel access (low privilege)
-
ExploitSubmit ticket modal repeatedly via Discord UI or API
-
ExecutionBot creates unbounded channels and DB records on each submission
-
PersistDiscord per-server channel quota exhausted
-
ImpactTicket system unavailable for legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker be a Discord user who has been granted access to the Quest Bot ticket panel on a server running any Quest Bot release prior to 1.1.8. CVSS PR:L confirms a low-privilege requirement - this is not unauthenticated exploitation; the attacker must hold at minimum the Discord role or permission that grants ticket panel visibility. Exploitation is further bounded by Discord's per-server channel limit, which acts as an external ceiling on resource exhaustion. Scope is strictly limited to availability of the ticketing system on the specific Discord server; no confidentiality impact, no integrity impact, and no cross-server or infrastructure impact applies (CVSS VC:N/VI:N/SC:N/SI:N/SA:N). Discord server administrators who restrict ticket panel access to known-trusted roles substantially reduce but do not eliminate exposure. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) scores 5.3 (Medium) and accurately reflects the threat model: network-accessible, low complexity, requiring only low privilege (Discord panel membership), with availability impact limited to the vulnerable system and no scope change to subsequent systems. The Low availability rating (VA:L) is appropriate - impact is confined to the Discord server's ticketing function, not broader infrastructure. No EPSS data was provided, and there is no CISA KEV listing and no public POC identified, indicating this is an unweaponized logic flaw. Real-world blast radius is narrow: an attacker must be a Discord member with ticket panel access on a specific server running a vulnerable Quest Bot instance, limiting opportunistic mass exploitation. There is no conflict between the CVSS signal and the description - both consistently indicate a low-privilege, network-reachable DoS with no confidentiality or integrity impact. |
| Exploit ScenarioDerived | A Discord server member with ticket panel access submits the ticket modal form in rapid succession using standard Discord UI interactions or scripted API calls. Because the bot creates a new channel and database record on every submission without checking for existing open tickets, the attacker quickly saturates the Discord server's channel limit and inflates the database, rendering the ticketing system non-functional for all users. No specialized exploit tooling is required - native Discord client interactions are sufficient. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 12, 2026
Ticket panel resource exhaustion in Quest Bot (open-source Discord bot, all versions prior to 1.1.8) allows any Discord user with panel access to flood a server with unlimited ticket channels and database records. Each modal submission unconditionally spawns a new Discord channel and database entry with no duplicate-ticket check and no rate limiting, enabling trivial availability denial of the ticketing system. No active exploitation (KEV) or public exploit code has been identified; vendor-released patch version 1.1.8 is confirmed available.
RemediationAI
Upgrade Quest Bot to version 1.1.8, which introduces open-ticket deduplication checks and submission rate limiting on the ticket modal handler. The patched release is available at https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.8. As a compensating control prior to patching, Discord server administrators should restrict ticket panel access to specific trusted roles via Discord permission settings, reducing the pool of users who can trigger modal submissions. Note that restricting panel access limits legitimate user self-service ticketing, which may be unacceptable for community support servers. No compensating control addresses the root cause - only the v1.1.8 patch resolves the missing idempotency and rate-limit logic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Quest Bot (CPE: cpe:2.3:a:duck-organization:questbot:*:*:*:*:*:*:*:*) is an open-source Discord bot implementing a support-ticket workflow where Discord users submit modal forms that trigger channel creation and database record insertion. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the modal submission handler performs no idempotency check (does the user already have an open ticket?) and imposes no cooldown or submission-rate constraint. Every modal completion unconditionally executes both a Discord channel-creation API call and a database INSERT, meaning a single user can exhaust Discord's per-server channel cap and bloat the backing database without restriction. The affected component is the ticket modal submission path in all pre-1.1.8 releases.
Know when Questbot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-accessible modal endpoint requires only Discord panel membership (PR:L); availability impact is Low and scope unchanged as exhaustion is confined to the bot's own channels and database.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking whether the same user already has an open ticket and without applying a cooldown. This issue has been patched in version 1.1.8.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper input validation in Quest Bot (an open-source Discord bot) prior to version 1.1.6 lets a guild moderator weapon
Discord role hierarchy bypass in Quest Bot (open-source Discord moderation bot) prior to version 1.1.6 allows moderators
Authorization bypass in Quest Bot Discord bot prior to version 1.1.6 lets low-privilege guild members invoke the purge a
Server-side request forgery in the open-source Discord bot Quest Bot (versions up to and including 1.1.8) lets any ordin
Mention injection in Quest Bot prior to version 1.1.6 allows Discord server moderators to embed @everyone or @here mass-
Exploit-DB