CVE-2026-28800 Natro Macro: Malicious actions allowed through Discord RC Commands by any user
Users with Discord Remote Control in non-private channels allow any channel member to execute arbitrary commands and access files on their computer.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-28800?
CVE-2026-28800 is a medium-severity missing authorization vulnerability in NatroTeam NatroMacro, published on 6 Mar 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Discord Remote Control set up in a non-private channel gives access to any user with the permission to send message in said channel access to do anything on their computer. This includes keyboard and mouse inputs and full file access. This issue has been patched in version 1.1.0.
Which versions are affected by CVE-2026-28800?
It affects 1 product.
Products include Natroteam Natro Macro.
How do I fix CVE-2026-28800?
No fix has been published for CVE-2026-28800 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-28800 being exploited?
There is no known exploitation of CVE-2026-28800 in the wild and no public exploit code.
Other vulnerabilities in NatroTeam NatroMacro
Sources
Also known as GHSA-ph9r-2qjm-ghvg.