Quest Bot vulnerabilities

Quest Bot is an open-source Discord bot that, prior to version 1.1.8, allowed users to repeatedly create new ticket channels without restrictions. The latest version still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking if the same user already has an open ticket.

Quest Bot is an open-source Discord bot that prior to version 1.1.6 did not suppress mentions when invoking the /warns command, potentially leading to mass pings of users.

Quest Bot is an open-source Discord bot. In versions prior to 1.1.6, the automod add command trims user input but does not reject an empty result, leading to the deletion of all non-bot guild messages.

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the invoking member, allowing users without channel-level moderation permissions to delete messages or change slowmode.

Quest Bot is a modern Discord bot that prior to version 1.0.3 had a privileged deployment process. An attacker could exploit a pull request from the main branch, allowing the deployment of malicious code in a privileged context.

Quest Bot is an open-source Discord bot that prior to version 1.1.6 allowed moderators with the relevant permissions to moderate users above them in the Discord role hierarchy, as long as the bot itself outranked the target. This bypasses Discord's normal role hierarchy protections.

Quest Bot is a modern Discord bot that prior to version 1.0.5 had a vulnerability in the AutoMod feature, allowing the removal of rules without verifying their association with the server. A user could identify the victim guild's AutoMod rule ID and remove it from another guild where they had Manage Server permissions.

Quest Bot is an open-source Discord bot that prior to version 1.0.5 did not suppress mentions in several moderation commands. The /unban and /unwarn commands still echoed user-controlled reason text in public bot messages, which could lead to mass pinging.

Quest Bot is an opensource modern Discord Bot that prior to version 1.0.4 allowed users to configure bot settings, including the ticket transcript channel. Users could set this channel to one they could read, leading to the exposure of private ticket messages.

Quest Bot is an open-source modern Discord Bot that, prior to version 1.0.4, allowed users to configure logging settings, resulting in the logging of deleted and edited message contents from every channel, including private ones that the configuring user could not access.

Quest Bot is a modern Discord bot designed for moderation, utilities, and support. In versions prior to 1.0.4, several moderation commands echoed user-controlled reason text in public bot replies without disabling mention parsing.

Quest Bot is a modern Discord bot that, prior to version 1.0.3, allowed normal users to create tickets with reasons containing @everyone, @here, user mentions, or role mentions. When the ticket was created, the bot posted the attacker-controlled reason into the new ticket channel without suppressing mentions.

Quest Bot is a modern Discord bot designed for moderation, utilities, and support. In versions prior to 1.0.3, a normal user could create a reminder containing @everyone or @here, resulting in mass notifications when triggered.

Quest Bot is a modern Discord bot that prior to version 1.0.3 had a vulnerability allowing users with Manage Server / ManageGuild permissions to assign arbitrary roles to new members. If the selected role had Administrator permissions and was below the bot's highest role, an attacker could gain full server admin rights.

Quest Bot is a modern Discord bot designed for moderation, utilities, and support. In versions prior to 1.0.1, any guild member could use the /automod add, /automod remove, and /automod list commands, allowing them to add moderation rules without proper permissions.