CrawlChat's Discord bot lacked a permission check that allowed any guild member who could use the jigsaw emoji to add messages to the bot's knowledge base. This missing authorize step made it possible to inject malicious content into the repository that the bot subsequently uses when answering queries, which could redirect users to malicious sites or supply false information. The weakness is identified as missing authorization validation (CWE‑862).

The vulnerability exists in the CrawlChat bot before version 0.0.8. All installations using the open‑source platform older than v0.0.8 are affected, while the released v0.0.8 and newer fixes the issue.

With a CVSS score of 5.7 the vulnerability is considered moderate. The EPSS score of less than one percent indicates a low probability of exploitation at the time of reporting, and it is not listed in CISA's KEV catalog. The likely attack path involves a guild member selecting the jigsaw emoji without proper privilege checks, thereby injecting arbitrary content into the knowledge base. Once in place, the attacker can manipulate bot responses across all integrations.