Quest Bot allowed any user with access to the ticket panel to create an arbitrary number of ticket channels with no per‑user limit or cooldown. Each request results in a new database record and a new Discord channel. The lack of limits creates a risk of resource exhaustion, which can degrade bot performance or bring the hosting system offline if the user or a malicious actor floods the system with ticket requests. This is classified as an unchecked resource consumption flaw (CWE‑770).

Duck Organization’s Quest Bot, any installation running a version of Quest Bot older than 1.1.8. The vulnerability is present whenever the ticket creation functionality is exposed, regardless of user role level if access to the ticket panel is granted. No specific OS or platform limitation is mentioned.

The CVSS score of 5.3 indicates a moderate severity. Because the bot processes modals from any user with panel access, the attack vector is straightforward through normal bot interactions and does not require privileged or lateral movement. EPSS data are not available, but the issue is not listed in the CISA KEV catalog, suggesting no widely known exploitation in the wild. The risk remains that an attacker could generate a large number of open tickets, consuming memory, database resources, or Discord API limits, potentially resulting in service degradation or denial of service for legitimate users.