duck-organization Questbot Vulnerabilities

Duck-organization Questbot vulnerabilities.

JSON RSS CSV 🔔 Create Alert Trigger

12 June 2026

Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown
CVE-2026-49347
Duck-organizationQuestbot5.3MEDIUM
Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.
CVE-2026-48485
Duck-organizationQuestbot2.1LOW
Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands
CVE-2026-47197
Duck-organizationQuestbot7.2HIGH
Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands.
CVE-2026-47195
Duck-organizationQuestbot7.1HIGH
Quest Bot: Empty automod rule causes every guild message to be deleted
CVE-2026-47196
Duck-organizationQuestbot8.4HIGH