CVE-2026-49347 — Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown
Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still crea…
Published: 2026-06-12 · CVSS: 5.3 · CVSS 4.0
Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking whether the same user already has an open ticket and without applying a cooldown. This issue has been patched in version 1.1.8.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7