Vulnerability · Published Jul 16, 2025 · Assigned by GitHub_M

CVE-2025-53943VoidBot Open-Source Has Improper Permission Check That Allows Unauthorized Command Execution

High 8.7

In plain English

A high-severity incorrect authorization in VoidBot_open-source from Death1Clown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 67.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

VoidBot Open-Source is a customizable Discord bot. VoidBot Open-Source versions 0.0.1 through 0.8.1 contain a vulnerability in the command handler where permission checks are not properly enforced for certain administrative commands. This allows users without the required roles or privileges to execute sensitive commands such as `ban`, `kick`, or `shutdown`, potentially disrupting server operations. Version 1.0.0 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
Death1Clown	VoidBot_open-source	>= 0.0.1, < 1.0.0

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/Death1Clown/VoidBot_open-source/security/advisories/GHSA-6rr8-9c8q-m5rv x_refsource_CONFIRM
https://discordjs.guide/popular-topics/permissions.html x_refsource_MISC