CVE-2026-47169CWE-266

Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts

High · published June 11, 2026

CVSS v4.0
7.5
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a user with Manage Server / ManageGuild, but without Manage Roles or Administrator, can configure the bot’s AutoRole feature to assign an arbitrary role to new members. If the selected role has Administrator and is below the bot’s highest role, the attacker can join with a controlled account and receive full server admin. This issue has been patched in version 1.0.3.

The record
Technical detail
CVSS v4.0
7.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-06-11T18:25Z
EPSS history
Timeline
  • 11 JUN 18:25Z
    Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts
    cvelistv5