Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

Red Discord Bot Mod Module Has Privilege Escalation Flaw

CVE-2020-15278 · published 6 years ago
Summary

An unauthorized user with high privileges in a Discord server can take actions they shouldn't be able to, like causing damage to the server. To fix this, update the Red Discord Bot to version 3.4.1 or disable the affected feature. Disabling the feature is not a permanent solution and you should still update as soon as possible.

What to do
  • Update cog creators red-discordbot to version 3.4.1.
  • Update cogboard red_discord_bot to version 3.4.1 or later.
Affected software
Ecosystem VendorProductAffected versions
pip cog creators red-discordbot < 3.4.1
Fix: upgrade to 3.4.1
– cogboard red_discord_bot < 3.4.1
cpe:2.3:a:cogboard:red_discord_bot:*:*:*:*:*:*:*:*
Original advisory text
Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit allows Discord users with a high privilege level within the guild to bypass hie...
Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By abusing this exploit, it is possible to perform destructive actions within the guild the user has high privileges in. This exploit has been fixed in version 3.4.1. As a workaround, unloading the Mod module with unload mod or, disabling the massban command with command disable global massban can render this exploit not accessible. We still highly recommend updating to 3.4.1 to completely patch this issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.1 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-285Improper Authorization
CWE-863Incorrect Authorization
Timeline
Published28 Oct 2020
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-mp9m-g7qj-6vqr · GHSA
CVE-2020-15278 · NVD
Track software like this
Free during beta