CVE-2024-39905 Red-DiscordBot vulnerable to Incorrect Authorization in commands API
Attackers can bypass channel management permissions in third-party cogs using a flawed API check, allowing unauthorized command execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39905?
CVE-2024-39905 is a medium-severity missing authorization vulnerability in Cog-Creators Red-DiscordBot, published on 11 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10.
Weakness: CWE-863
Which versions are affected by CVE-2024-39905?
3 open source packages ship an affected version, including red-discordbot and Red-DiscordBot.
| Package | Affected | Fixed in |
|---|---|---|
red-discordbot PyPI | From 3.5.0 | 3.5.10 |
red-discordbot PyPI | From 3.5.0 | 3.5.10 |
Red-DiscordBot PyPI | From 3.5.0 | 3.5.10 |
How do I fix CVE-2024-39905?
Upgrade red-discordbot to 3.5.10 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-39905 being exploited?
There is no known exploitation of CVE-2024-39905 in the wild and no public exploit code.
Sources
Also known as GHSA-5jq8-q6rj-9gq4, PYSEC-2026-1865.