CVE-2021-48006 Details
Description
PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.
A privilege escalation vulnerability exists in PocketMine-MP versions prior to 4.0.3, where the server fails to handle case sensitivity correctly when removing operator names from the ops.txt file. The 'removeOp' function converts the input name to lowercase but only deletes entries that match exactly. As a result, if an operator name is saved with uppercase letters, it cannot be removed using the 'deop' command. This oversight allows players to retain operator status until the ops.txt entry is manually deleted.
To address this vulnerability, users can manually remove the affected entries from ops.txt. Alternatively, updating to PocketMine-MP version 4.0.3 or later will resolve the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 6, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PocketMine-MP | >= 0, < 4.0.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 6, 2026 | CVE Modified | [email protected] |
| Sep 6, 2026 | New CVE Received | [email protected] |