VULNERABILITY INTELLIGENCE

CVE-2021-48006

CVSS score3.3 LOW
EPSS probability0.15%
CISA KEVNot currently listed
Published2026-09-06
Last modified2026-10-08
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.

Weakness classification

  • disclosure@vulncheck.com: CWE-178

Primary references