Read the docs
TI-2024-30378 Aliases CVE-2024-45307

SudoBot missing authorization check in `-config` command

Priority MEDIUM 42CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

SudoBot, a Discord moderation bot, is vulnerable to privilege escalation and exploit of the `-config` command in versions prior to 9.26.7. Anyone is theoretically able to update any configuration of the bot and potentially gain control over the bot's settings. Every version of v9 before v9.26.7 is affected. Other versions (e.g. v8) are not affected. Users should upgrade to version 9.26.7 to receive a patch. A workaround would be to create a command permission overwrite in the Database. A SQL statement provided in the GitHub Security Advisor can be executed to create a overwrite that disallows users without `ManageGuild` permission to run the `-config` command. Run the SQL statement for every server the bot is in, and replace `<guild_id>` with the appropriate Guild ID each time.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00317 24th percentileScored 2026-11-07
Fix Fixed sudobot (onesoft-sudo): 9.26.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
onesoft-sudosudobot9.0.0 to before 9.26.79.26.7Patch availableCNA
  • sudobot Vendoronesoft-sudo Affected 9.0.0 to before 9.26.7 Fixed in 9.26.7 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:onesoftnet:sudobot:*:*:*:*:*:*:*:*9.0.0 to before 9.26.7VulnerableOnesoftnet
  • cpe:2.3:a:onesoftnet:sudobot:*:*:*:*:*:*:*:* Versions 9.0.0 to before 9.26.7 Vulnerable ·Onesoftnet

Remediation

  • Fix · CNA sudobot (onesoft-sudo) Fixed in 9.26.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45307

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences