CVE-2026-47173CWE-116

Quest Bot: Ticket reason allows mass-mention injection

Medium · published June 11, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a ticket with a reason containing @everyone, @here, user mentions, or role mentions. When the ticket is created, the bot posts the attacker-controlled reason into the new ticket channel without suppressing mentions. If the bot has permission to use those mentions, the attacker can make the bot ping staff or everyone with access to the ticket channel. This issue has been patched in version 1.0.3.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00445 · 37.6th percentile
Weakness
CWE-116 · Improper Encoding or Escaping of Output
Published
2026-06-11T18:29Z
EPSS history
Timeline
  • 11 JUN 18:29Z
    Quest Bot: Ticket reason allows mass-mention injection
    cvelistv5