Skip to contentDuck-organization Quest-bot vulnerabilities
- duck-organization quest-botQuest Bot: AutoMod removal can delete rules from another guild by global rule IDCVE-2026-471898.3 High
- duck-organization quest-botQuest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions.CVE-2026-471882.3 Low
- duck-organization quest-botQuest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channelCVE-2026-471775.7 Medium
- duck-organization quest-botQuest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channelCVE-2026-471765.7 Medium
- duck-organization quest-botQuest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pingsCVE-2026-471752.3 Low
- duck-organization quest-botQuest Bot: Ticket reason allows mass-mention injectionCVE-2026-471736.3 Medium
- duck-organization quest-botQuest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.CVE-2026-47172Public exploit9.5 Critical
- duck-organization quest-botQuest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`CVE-2026-471718.8 High
- duck-organization quest-botQuest Bot: Unprivileged users can create and remove AutoMod rules.CVE-2026-471637.2 High
- duck-organization quest-botQuest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accountsCVE-2026-471697.5 High