CVE-2026-47197: Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands

Synopsis

A role hierarchy bypass vulnerability exists in Quest Bot, an open-source Discord moderation bot. The flaw is reachable over the network by any user holding a low-privilege Discord moderator role, with no additional interaction required from a victim. Successful exploitation lets a lower-ranked moderator ban, kick, mute, unmute, warn, or rename users who outrank them in the Discord role hierarchy, as long as the bot itself holds a higher position than the target. No fix version has been published upstream yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment the upstream fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker sends commands to the bot over the network via Discord's API, so the service must be reachable from the internet.

• AuthenticationRequired

  The attacker must hold a low-privilege Discord account that has been granted a relevant moderation permission bit in the target server; any such account is sufficient.

• Victim interactionNot required

  No action from the targeted user or any other party is needed to trigger the hierarchy bypass.

• Attack complexityDetail

  Exploitation is generally reliable but depends on the precondition that the bot holds a higher role than the target user (AT:P), introducing an environmental factor the attacker cannot always control.

Blast Radius

• A lower-ranked moderator can permanently ban higher-ranked users from the Discord server, removing their access entirely.
• An attacker can kick, mute, or unmute targeted users, disrupting server operations and silencing or reinstating accounts without authorization.
• An attacker can rename any user the bot outranks, enabling impersonation or harassment of high-privilege accounts.
• Warn records can be written against higher-ranked users, corrupting moderation audit trails and potentially triggering automated punishment thresholds.