Quest Bot, an open‑source Discord moderation bot, allowed any guild member who could use slash commands to add or remove AutoMod rules because the commands lacked required Discord permission checks and no runtime moderator privilege validation. This omission enabled unprivileged users to create rules that match common text patterns and trigger automatic deletion of other users’ messages. As a result, an attacker could arbitrarily delete content from a guild, leading to loss of user data and undermining the moderation integrity of the community.

The vulnerability affected all installations of duck‑organization Quest Bot prior to version 1.0.1, all of which lacked hard‑coded permission enforcement for the /automod add, /automod remove, and /automod list commands. Any Discord guild where the bot was present and where members had permission to invoke slash commands was susceptible, irrespective of the guild’s configuration settings.

The CVSS score of indicates a high severity, and although EPSS data is not available, the lack of a KEV listing suggests no widespread exploitation has been reported yet; however, the attack vector is straightforward—any guild member can trigger the command via the normal Discord UI—making the vulnerability readily actionable in environments where the bot is active. This poses a moderate to high risk, especially for guilds that rely on the bot’s automated moderation to enforce community standards.