CVE-2026-47195: Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands.

Synopsis

This is a permission-enforcement bypass in Quest Bot, an open-source Discord bot. The vulnerability is reachable over the network by any low-privilege authenticated user and requires no victim interaction; the bot checks only guild-level permissions and ignores channel-level permission overwrites when processing purge and slowmode commands. A successful attacker can delete messages in channels they are explicitly denied moderation access to, or change the slowmode setting on those channels, undermining channel-specific access controls. No fix version has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker sends commands to the bot over the network via the Discord API, so the affected service must be reachable over the network.

• AuthenticationRequired

  The attacker must hold a valid low-privilege guild membership account; anonymous access is not sufficient.

• Victim interactionNot required

  No victim action is needed; the attacker issues commands directly to the bot without involving another user.

• Attack complexityDetail

  The exploit is reliable and condition-free in most deployments, though the CVSS vector notes an attack requirement (AT:P) indicating that specific channel-level permission overwrites must already be configured to create the exploitable discrepancy.

Blast Radius

• Attacker bulk-deletes message history in channels they are explicitly restricted from moderating, permanently removing conversation records.
• Attacker modifies the slowmode setting on restricted channels, disrupting communication flow for legitimate members.
• Channel-level administrative boundaries are bypassed, allowing a low-privilege member to exercise moderation capabilities the server owner intended to revoke.
• Downstream systems or audit logs that depend on channel integrity can reflect unauthorized changes originating from the bot.