CVE-2026-49347

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49347", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-29T14:35:45.903Z", "datePublished": "2026-06-12T11:54:07.695Z", "dateUpdated": "2026-06-12T13:41:50.369Z"}, "containers": {"cna": {"title": "Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/duck-organization/questbot/security/advisories/GHSA-r56q-v363-367q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-r56q-v363-367q"}, {"name": "https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.8"}], "affected": [{"vendor": "duck-organization", "product": "questbot", "versions": [{"version": "< 1.1.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T11:54:07.695Z"}, "descriptions": [{"lang": "en", "value": "Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking whether the same user already has an open ticket and without applying a cooldown. This issue has been patched in version 1.1.8."}], "source": {"advisory": "GHSA-r56q-v363-367q", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-r56q-v363-367q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-12T13:41:37.941109Z", "id": "CVE-2026-49347", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T13:41:50.369Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49347", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T13:41:37.941109Z"}}}], "references": [{"url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-r56q-v363-367q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T13:41:07.627Z"}}], "cna": {"title": "Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown", "source": {"advisory": "GHSA-r56q-v363-367q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "duck-organization", "product": "questbot", "versions": [{"status": "affected", "version": "< 1.1.8"}]}], "references": [{"url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-r56q-v363-367q", "name": "https://github.com/duck-organization/questbot/security/advisories/GHSA-r56q-v363-367q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.8", "name": "https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking whether the same user already has an open ticket and without applying a cooldown. This issue has been patched in version 1.1.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T11:54:07.695Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49347", "state": "PUBLISHED", "dateUpdated": "2026-06-12T13:41:50.369Z", "dateReserved": "2026-05-29T14:35:45.903Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-12T11:54:07.695Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "questbot", "vendor": "duck-organization", "versions": [{"status": "affected", "version": "< 1.1.8"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking whether the same user already has an open ticket and without applying a cooldown. This issue has been patched in version 1.1.8."}, {"lang": "es", "value": "Quest Bot es un bot de Discord de c\u00f3digo abierto. Antes de la versi\u00f3n 1.1.8, cualquier usuario que pueda acceder al panel de tickets puede crear repetidamente nuevos canales de tickets. La \u00faltima versi\u00f3n todav\u00eda crea un nuevo ticket en la base de datos y un canal de Discord por cada env\u00edo de formulario modal de ticket completado, sin comprobar si el mismo usuario ya tiene un ticket abierto y sin aplicar un tiempo de espera. Este problema ha sido parcheado en la versi\u00f3n 1.1.8."}], "id": "CVE-2026-49347", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49347", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-12T13:41:37.941109Z", "version": "2.0.3"}}]}, "published": "2026-06-12T13:16:34.030", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/duck-organization/questbot/releases/tag/questbot-v1.1.8"}, {"source": "security-advisories@github.com", "url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-r56q-v363-367q"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/duck-organization/questbot/security/advisories/GHSA-r56q-v363-367q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "questbot", "source": "cna", "vendor": "duck-organization"}, "product": "questbot", "vendor": "duck-organization"}], "created": "2026-06-12T13:30:27.912485+00:00", "updated": "2026-06-12T20:20:29.808814+00:00", "vendors": ["duck-organization", "duck-organization$PRODUCT$questbot"]}