Auth bypass in Duck-Organization Quest-Bot

CVE-2026-47163

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.1, any guild member who can invoke slash commands can use /automod add, /automod remove, and /automod list because the command has no Discord default permission requirement and no runtime moderator permission check. An attacker can add a rule matching common text and make the bot delete other users’ messages. This issue has been patched in version 1.0.1.

Vulnerability class: Broken Access Control

EPSS: 0.002 (11.9th percentile) — read the EPSS interpretation.