CVE-2026-47176 Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel
A user with bot configuration access can leak private channel message contents to a public log channel, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-47176?
CVE-2026-47176 is a medium-severity vulnerability in duck-organization quest-bot, published on 11 Jun 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a user who can configure bot settings can enable logging and choose a logging channel they can read. The bot then logs deleted and edited message contents from every channel it can see, including private channels the configuring user cannot access. This issue has been patched in version 1.0.4.
Weakness: CWE-200
Which versions are affected by CVE-2026-47176?
How do I fix CVE-2026-47176?
No fix has been published for CVE-2026-47176 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-47176 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47176 exists.
Sources
Also known as GHSA-fvvp-8g5q-hrc7.