CVE-2026-47169: Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts

Synopsis

This is a privilege-escalation vulnerability in Quest Bot, an open-source Discord moderation and utility bot. A user holding the Manage Server permission (but lacking Administrator or Manage Roles) can abuse the AutoRole feature to assign an arbitrary role, including one with Administrator privileges, to any newly joined account they control. Successful exploitation gives the attacker full server administrator access. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker configures AutoRole over the network through Discord's API and then triggers exploitation by having a controlled account join the server remotely.

• AuthenticationRequired

  An admin-level account is needed to reach the AutoRole configuration endpoint; however, in this context the attacker only needs a Discord account with the Manage Server permission, which is a scoped privilege below full Administrator.

• Victim interactionNot required

  No interaction from another user or victim is required; the attacker configures the malicious AutoRole assignment and joins with a controlled account independently.

• Attack complexityDetail

  The CVSS vector notes an attack-requirements condition (AT:P), meaning specific environmental prerequisites must be met, namely that the target role with Administrator must exist below the bot's highest role position, but no race conditions or unpredictable system states are involved once that condition is satisfied.

Blast Radius

• The attacker gains full Administrator access on the Discord server, allowing them to read all channels and message history, including private or restricted content.
• With Administrator privileges the attacker can modify server settings, channels, roles, and permissions, overwriting any existing configuration.
• The attacker can kick or ban legitimate members, disrupt moderation workflows, and effectively take over server operations entirely.