CVE-2026-47189
Quest Bot: AutoMod removal can delete rules from another guild by global rule ID
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the AutoMod remove flow looks up and deletes rules by global database ID without verifying that the rule belongs to the guild where the command is executed. A user can learn a victim guild’s AutoMod rule ID through autocomplete, then remove that rule from another guild where they have Manage Server. This issue has been patched in version 1.0.5.
| CWE | CWE-639 |
| Vendor | duck-organization |
| Product | quest-bot |
| Published | Jun 11, 2026 |
| Last Updated | Jun 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for duck-organization quest-bot
Be the first to know when new unknown vulnerabilities affecting duck-organization quest-bot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
duck-organization / quest-bot
< 1.0.5