CVE-2026-47163: Quest Bot: Unprivileged users can create and remove AutoMod rules.

Synopsis

This is an authorization bypass vulnerability in Quest Bot, an open-source Discord moderation bot. Because the /automod add and /automod remove slash commands have no permission check at the command definition level or at runtime, any guild member who can invoke slash commands can create or delete AutoMod rules without needing moderator privileges. A successful attacker can silently suppress other users' messages by adding overly broad matching rules, or dismantle existing moderation rules entirely. Note: the description states the issue has been patched in version 1.0.1, though no fix version has been formally published in the advisory at this time; HarborGuard is tracking the advisory for confirmed patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker interacts with the bot over the network via Discord's slash command interface, so the bot must be reachable and operational on the network.

• AuthenticationRequired

  The attacker must hold a low-privilege Discord guild member account capable of invoking slash commands; no elevated or moderator role is needed beyond basic membership.

• Victim interactionNot required

  The attacker invokes the slash commands directly and does not need any action from another user or administrator to exploit the vulnerability.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions or special environmental state are required to successfully invoke the unguarded commands.

Blast Radius

• An attacker adds AutoMod rules that match common words or phrases, causing the bot to automatically delete legitimate messages from other guild members.
• An attacker removes existing AutoMod rules, disabling active moderation filters and allowing previously blocked content to pass through.
• Persistent manipulation of AutoMod rules lets an attacker selectively silence specific users or topics without any visible direct action, making abuse difficult to attribute quickly.
• Guild administrators lose integrity over their moderation configuration, as any member can overwrite or erase rule sets without authorization.