CVE-2026-47197CWE-862

Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands

High · published June 12, 2026

CVSS v4.0
7.2
EPSS
0%
Percentile
31.5
In the wild
Unconfirmed
What it is

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to moderate users above them in the Discord role hierarchy, as long as the bot itself outranks the target. This bypasses Discord’s normal role hierarchy protections and lets lower-ranked moderators ban, kick, timeout, untimeout, warn, or rename higher-ranked users. This issue has been patched in version 1.1.6.

The record
Technical detail
CVSS v4.0
7.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:H
EPSS
0.00387 · 31.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-06-12T11:52Z
EPSS history
Timeline
  • 12 JUN 11:52Z
    Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands
    cvelistv5