Advisories · Technology

duck-organization questbot.

Every CVE that names duck-organization questbot among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-49347 CVE record

CVSS 5.3 Medium

Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown
- duck-organization questbot
- Denial of service
Not analysed yet 12 Jun 2026
CVE-2026-48485 CVE record

CVSS 2.1 Low

Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.
- duck-organization questbot
- CWE-116
Not analysed yet 12 Jun 2026
CVE-2026-47197 CVE record

CVSS 7.2 High

Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands
- duck-organization questbot
- Broken access control
Not analysed yet 12 Jun 2026
CVE-2026-47195 CVE record

CVSS 7.1 High

Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands.
- duck-organization questbot
- Broken access control
Not analysed yet 12 Jun 2026
CVE-2026-47196 CVE record

CVSS 8.4 High

Quest Bot: Empty automod rule causes every guild message to be deleted
- duck-organization questbot
- CWE-20
Not analysed yet 12 Jun 2026