CVE-2026-47196: Quest Bot: Empty automod rule causes every guild message to be deleted

Synopsis

A logic flaw in Quest Bot, an open-source Discord bot, allows any low-privilege guild member to add a blank automod rule that causes the bot to delete every non-bot message in the guild. The vulnerability is reachable over the network and requires only a low-privilege account (standard guild membership). Successful exploitation gives the attacker persistent, broad message deletion across the entire guild, effectively silencing all communication. A patched-image rebuild at version 1.1.6 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the bot's command interface over the network, specifically through the Discord API, to submit the malformed automod rule.

• AuthenticationRequired

  Any low-privilege Discord account with standard guild membership is sufficient; no elevated or administrative role is needed.

• Victim interactionNot required

  No user action is required after the rule is stored; the bot begins deleting all non-bot messages automatically.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: submitting a whitespace-only string to the automod add command reliably triggers the flaw on every subsequent message.

Blast Radius

• The attacker causes the bot to delete every non-bot message posted in the guild, wiping ongoing conversations in real time.
• Guild communication is effectively halted for all members for as long as the blank rule remains active, disrupting community operations.
• Moderators and administrators lose visibility into member activity because messages are removed before they can be read or logged.
• The impact extends to all channels monitored by the bot, meaning a single malformed rule affects the entire server scope simultaneously.