Quest Bot transmits closed ticket histories to a transcript channel configured by a bot administrator. If the transcript channel is one that the administrator can read, the entire ticket content—including private messages—is posted there. This exposes confidential information to users who otherwise could not view the original ticket. The flaw is a data‑exposure issue (CWE‑200).

The vulnerability affects all releases of Quest Bot by duck‑organization prior to version 1.0.4. Users of earlier builds must check the version they are running.

With a CVSS score of 5.7, the risk level is moderate. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a user with permission to configure bot settings; by selecting an inappropriate transcript channel, the attacker can cause private tickets to be published to a broader audience. The exploitation requires only configuration privileges, making it relatively straightforward if such privileges are given to a malicious participant.