Red-DiscordBot vulnerable to Incorrect Authorization in commands API
Impact
Due to a bug in Red's Core API, 3rd-party cogs using the @commands.can_manage_channel() command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel.
None of the core commands or core cogs are affected. The maintainers of the project are not aware of any public 3rd-party cog utilizing this API at the time of writing this advisory.
The @commands.mod_or_can_manage_channel(), @commands.admin_or_can_manage_channel(), and @commands.guildowner_or_can_manage_channel() command permission checks are unaffected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/AU:Y/R:U/RE:L
Patches
The problem was patched in PR #6398 and later released in version 3.5.10.
Workarounds
Any cog using the @commands.can_manage_channel() command permission check should be unloaded until an upgrade to a patched version can be performed.
References
https://github.com/Cog-Creators/Red-DiscordBot/pull/6398 https://github.com/Cog-Creators/Red-DiscordBot/releases/tag/3.5.10 https://pypi.org/project/Red-DiscordBot/3.5.10/
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | red-discordbot | >= 3.5.0, < 3.5.10 | 3.5.10 |
References
- https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-5jq8-q6rj-9gq4
- https://nvd.nist.gov/vuln/detail/CVE-2024-39905
- https://github.com/Cog-Creators/Red-DiscordBot/pull/6398
- https://github.com/Cog-Creators/Red-DiscordBot/commit/0b0b23b9717b40ed4f8715720b199417c8e89750
- https://github.com/Cog-Creators/Red-DiscordBot
- https://pypi.org/project/red-discordbot
- https://github.com/advisories/GHSA-5jq8-q6rj-9gq4
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-863- Platform
- Python (PyPI)
- Package
red-discordbot- Disclosed
- 11.07.2024
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1865 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-5jq8-q6rj-9gq4 - CC BY 4.0
Vulnerability history: red-discordbot
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 08.2020 07.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 3
Disclosures per year
- 2020: 3
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 0
-
Red-DiscordBot vulnerable to Incorrect Authorization in commands API this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.