CVE-2024-39905

Advisory

A bug in Red's Core API affects the @commands.can_manage_channel() command permission check. This bug may authorize a user to execute a command even if they do not have the permissions to manage a channel, if additional permission controls are not in place. Core commands and core cogs are unaffected by this issue. At the time of this advisory, the maintainers are not aware of any public 3rd-party cogs utilizing this API. The following command permission checks are unaffected: @commands.mod_or_can_manage_channel(), @commands.admin_or_can_manage_channel(), and @commands.guildowner_or_can_manage_channel().

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/Cog-Creators/Red-DiscordBot/commit/0b0b23b9717b40ed4f8715720b199417c8e89750
• https://github.com/advisories/GHSA-5jq8-q6rj-9gq4
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39905