PatchSiren cyber security CVE debrief
CVE-2026-47195 duck-organization CVE debrief
CVE-2026-47195 is a HIGH severity vulnerability in Quest Bot prior to version 1.1.6. The purge and slowmode commands check only guild-level permissions on the invoking member. They do not check the member’s effective permissions in the channel where the command is run. A user denied channel-level moderation permissions can still delete messages or change slowmode through the bot. This issue has been patched in version 1.1.6.
- Vendor
- duck-organization
- Product
- questbot
- CVSS
- HIGH 7.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-12
- Original CVE updated
- 2026-06-12
- Advisory published
- 2026-06-12
- Advisory updated
- 2026-06-12
Who should care
Users of Quest Bot prior to version 1.1.6 should update to version 1.1.6 or later to mitigate this vulnerability.
Technical summary
The CVSS score for this vulnerability is 7.1, indicating a HIGH severity. The vulnerability is caused by the lack of channel-level permission checks for the purge and slowmode commands.
Defensive priority
HIGH
Recommended defensive actions
- Update Quest Bot to version 1.1.6 or later.
- Review and adjust channel-level permissions for users of Quest Bot.
Evidence notes
The CVE record and NVD detail can be found at [cve-org] and [nvd], respectively. Additional information can be found at [ref-4] and [ref-5].
Official resources
CVE-2026-47195 was published on 2026-06-12T13:16:32.930Z and modified on 2026-06-12T15:56:54.563Z.