CVE-2026-47195

Vulnerability

Quest Bot versions prior to 1.1.6 contain an authorization bypass in the purge and slowmode moderation commands. The commands validate the invoking member’s permissions using only member.permissions.has(), which checks guild-level permissions rather than effective permissions in the channel where the command is executed [1]. This means channel-specific permission overwrites (e.g., denying ManageMessages or ManageChannels on a per-channel basis) are not considered. The vulnerable code is in apps/bot/src/commands/moderation/purge.ts and apps/bot/src/commands/moderation/slowmode.ts [1]. The fix is released in version 1.1.6 [2].

Exploitation

An attacker must have guild-level ManageMessages or ManageChannels permission but be denied those permissions in a specific channel via a channel overwrite. The attacker then invokes the purge or slowmode slash command in that channel. The bot, lacking an effective permission check, will execute channel.bulkDelete(), channel.messages.delete(), or channel.setRateLimitPerUser() on behalf of the attacker [1]. No additional authentication or user interaction beyond normal Discord slash command usage is required.

Impact

A successful exploit allows the attacker to delete any number of messages in the channel (up to the bot’s permission limit) or alter the channel’s slowmode setting, despite having those permissions explicitly denied at the channel level. This undermines channel-specific moderation controls and can be used to disrupt conversations or evade moderation [1].

Mitigation

Upgrade to Quest Bot version 1.1.6, which was released on an unknown date before June 12, 2026, and includes the fix [2]. The fix requires checking effective channel permissions using Discord’s channel permission calculation for the invoking member rather than only guild-level permissions [1]. No workarounds are documented; server administrators should ensure the bot is updated.