PT-2026-48862 · Duck Organization · Quest-Bot

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-49347

Mitre

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking whether the same user already has an open ticket and without applying a cooldown. This issue has been patched in version 1.1.8.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-49347

Affected Products

Quest-Bot

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-49347 · Security Note
• https://github.com/duck-organization/questbot/security/advisories/GHSA-r56q-v363-367q · Note
• https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.8 · Note