The vulnerability resides in the logging component of Quest Bot, an open‑source Discord bot. Users who are granted permission to configure the bot can enable logging and choose a channel in which log messages will be posted. When logging is activated, the bot records the contents of deleted and edited messages from every channel it has access to, even channels that the configuring user cannot read. Consequently, a privileged user can use the bot to retrieve private channel conversations through an innocuous log channel, resulting in a disclosure of confidential information.

The affected product is Quest Bot from duck‑organization. Versions prior to 1.0.4 contain the flaw. Any deployment of Quest Bot 1.0.3 or earlier that allows a user to configure logging is vulnerable. The fix is available in version 1.0.4 and later.

The CVSS score of 5.7 indicates moderate severity. EPSS data is not available, so the current exploitation likelihood is unknown. The vulnerability is not listed in KEV. The likely attack vector is remote; an attacker must possess a privileged Discord role that allows configuration of the bot’s logging settings. If successful, the attacker can read private channel messages via a log channel that is otherwise readable by the user who set it up. Because the flaw is purely in data handling, it does not grant arbitrary code execution or denial of service.