Quest Bot, an open‑source Discord bot, fails to validate per‑channel permissions for the purge and slowmode commands in versions prior to 1.1.6. Without checking a member’s effective permissions within the channel, a user lacking moderation rights can still delete channel messages or alter the slow‑mode setting through the bot. This breach of access control allows an attacker with limited permissions to perform actions normally reserved for moderators, potentially disrupting channels or deleting legitimate content.

Applicable to the Quest Bot project hosted by duck‑organization on Discord. Any installations of Quest Bot older than version 1.1.6 are affected; the vulnerability was resolved in release v1.1.6.

With a CVSS score of 7.1, the vulnerability presents moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating it has not yet been exploited in the wild. The likely attack vector is through the Discord platform, where an attacker uses the bot’s purge or slowmode command to bypass channel‑level moderation restrictions. Exploitation requires only a Discord user with the bot’s command permissions; no additional foothold or elevated privileges are needed.