TI-2024-26799 Aliases CVE-2024-39905 GHSA-5jq8-q6rj-9gq4

Red-DiscordBot vulnerable to Incorrect Authorization in commands API

LOW 30CWE-863Published 2024-07-11 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00413 35th percentileScored 2026-11-07

Fix Fixed Red-DiscordBot (Cog-Creators): 3.5.10Red-DiscordBot (PyPI): 3.5.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cog-Creators	Red-DiscordBot	3.5.0 to before 3.5.10	3.5.10	Patch available	CNA
—	Red-DiscordBot (PyPI)	3.5.0 to before 3.5.10	3.5.10	Patch available	GHSA-5jq8-q6rj-9gq4

Red-DiscordBot VendorCog-Creators Affected 3.5.0 to before 3.5.10 Fixed in 3.5.10 Patch available CNA
Red-DiscordBot (PyPI) Vendor— Affected 3.5.0 to before 3.5.10 Fixed in 3.5.10 Patch available GHSA-5jq8-q6rj-9gq4

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cogboard:red_discord_bot:3.5.0:::::::*	3.5.0	—	Cog-Creators

cpe:2.3:a:cogboard:red_discord_bot:3.5.0:*:*:*:*:*:*:* Versions 3.5.0 — ·Cog-Creators

Remediation

Fix · CNA Red-DiscordBot (Cog-Creators) Fixed in 3.5.10
Fix · GHSA-5jq8-q6rj-9gq4 Red-DiscordBot (PyPI) Fixed in 3.5.10 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-39905
2026-10-03 Alias added: GHSA-5jq8-q6rj-9gq4

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-39905

Other 4

TI-2020-11913 Remote Code Execution in Red Discord Bot CVSS 3.1CRITICAL 9.6
TI-2020-11919 Remote Code Execution in Red Discord Bot CVSS 3.1HIGH 8.5
TI-2020-16070 Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) Vulnerability CVSS 3.1HIGH 8.7
TI-2020-12048 Unauthorized privilege escalation in Mod module CVSS 3.1HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences