CVE-2022-23604

x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands. The issue has been patched in version 1.10.0. One may unload the Defender cog as a workaround.

• CWE-269

• https://github.com/Twentysix26/x26-Cogs/commit/72dd9323cb4c90f3a5accac7087605375d178246Patch, Third Party Advisory
• https://github.com/Twentysix26/x26-Cogs/releases/tag/v1.10Release Notes, Third Party Advisory
• https://github.com/Twentysix26/x26-Cogs/security/advisories/GHSA-cfh8-v56j-5757Issue Tracking, Third Party Advisory
• https://github.com/Twentysix26/x26-Cogs/commit/72dd9323cb4c90f3a5accac7087605375d178246Patch, Third Party Advisory
• https://github.com/Twentysix26/x26-Cogs/releases/tag/v1.10Release Notes, Third Party Advisory
• https://github.com/Twentysix26/x26-Cogs/security/advisories/GHSA-cfh8-v56j-5757Issue Tracking, Third Party Advisory

Published

Feb 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23598laminas-form is a package for validating and displaying simp…6.1
• CVE-2022-23599Products.ATContentTypes are the core content types for Plone…6.1
• CVE-2022-23600fleet is an open source device management, built on osquery.…6.5
• CVE-2022-23601Symfony is a PHP framework for web and console applications …8.8
• CVE-2022-23602Nimforum is a lightweight alternative to Discourse written i…8.1
• CVE-2022-23603iTunesRPC-Remastered is a discord rich presence application …6.1
• CVE-2022-23605Wire webapp is a web client for the wire messaging protocol.…2.3
• CVE-2022-23606Envoy is an open source edge and service proxy, designed for…6.5
• CVE-2022-23607treq is an HTTP library inspired by requests but written on …6.5
• CVE-2022-23608PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-23609iTunesRPC-Remastered is a Discord Rich Presence for iTunes o…9.1
• CVE-2022-2361The WP Social Chat WordPress plugin before 6.0.5 does not sa…4.8