CVE-2025-53943 VoidBot Open-Source Has Improper Permission Check That Allows Unauthorized Command Execution
Unauthorized users can execute administrative commands like ban or kick due to improper permission checks in VoidBot Open-Source.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-53943?
CVE-2025-53943 is a high-severity missing authorization vulnerability in Death1Clown VoidBot_open-source, published on 16 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
VoidBot Open-Source is a customizable Discord bot. VoidBot Open-Source versions 0.0.1 through 0.8.1 contain a vulnerability in the command handler where permission checks are not properly enforced for certain administrative commands. This allows users without the required roles or privileges to execute sensitive commands such as `ban`, `kick`, or `shutdown`, potentially disrupting server operations. Version 1.0.0 fixes the issue.
Weakness: CWE-863
Which versions are affected by CVE-2025-53943?
How do I fix CVE-2025-53943?
No fix has been published for CVE-2025-53943 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-53943 being exploited?
There is no known exploitation of CVE-2025-53943 in the wild and no public exploit code.