CVE-2026-47197

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47197
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47197.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47197
Aliases
  • GHSA-qw95-583r-hrwp
Published
2026-06-12T11:52:48.796Z
Modified
2026-07-15T01:49:01.269321030Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:H CVSS Calculator
Summary
Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands
Details

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to moderate users above them in the Discord role hierarchy, as long as the bot itself outranks the target. This bypasses Discord’s normal role hierarchy protections and lets lower-ranked moderators ban, kick, timeout, untimeout, warn, or rename higher-ranked users. This issue has been patched in version 1.1.6.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47197.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/duck-organization/questbot

Affected ranges

Type
GIT
Repo
https://github.com/duck-organization/questbot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
699eade86bb4b9ed6bf78ba70681192a4d284451
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.1.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

questbot-v1.*
questbot-v1.0.1
questbot-v1.0.2
questbot-v1.0.3
questbot-v1.0.4
questbot-v1.0.5
questbot-v1.1.0
questbot-v1.1.1
questbot-v1.1.2
questbot-v1.1.3
questbot-v1.1.4
questbot-v1.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47197.json"