Quest Bot allows a moderator with the standard moderation permission bit to act on users higher in the Discord role hierarchy as long as the bot’s role outranks the target user. This bypasses Discord’s built‑in role hierarchy controls and enables lower‑ranked moderators to ban, kick, mute, unmute, warn, or rename higher‑ranked users, compromising the integrity and availability of moderation functions.

The affected product is Quest Bot by duck-organization. Versions prior to 1.1.6 are affected; the fix is included in release 1.1.6 and later.

The issue carries a CVSS score of 7.2, indicating a fairly high severity. EPSS data is not available, but the vulnerability can be exploited by any moderator who has the relevant Discord permission bit and can interact with the bot. Because the bot must outrank the target user, the attack requires the bot to be assigned a higher role; this is a typical scenario in many servers. The vulnerability is not listed in the CISA KEV catalog, so no publicly available exploit campaigns are documented yet.