{"id":"CVE-2021-48006","aliases":["EUVD-2021-34876","GHSA-5mrr-24gh-4jwh","GHSA-j5qg-w9jg-3wg3"],"status":"published","title":"PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity","description":"PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00155,"percentile":0.04686,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-178"],"published":"2021-12-16T18:53:57Z","modified":"2026-10-20T10:55:11Z","fixes":[{"ecosystem":"Packagist","package":"pocketmine/pocketmine-mp","fixed_in":["4.0.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"pocketmine/pocketmine-mp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"pocketmine/pocketmine-mp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3"}]}],"versions":["3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.10.0","3.10.1","3.11.0","3.11.1","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.12.0","3.12.1","3.12.2","3.12.3","3.12.4","3.12.5","3.12.6","3.13.0","3.13.1","3.14.0","3.14.1","3.14.2","3.14.3","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.16.0","3.16.1","3.17.0","3.17.1","3.17.2","3.17.3","3.17.4","3.17.5","3.17.6","3.17.7","3.18.0","3.18.1","3.18.2","3.19.0","3.19.1","3.19.2","3.19.3","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.20.0","3.21.0","3.21.1","3.22.0","3.22.1","3.22.2","3.22.3","3.22.4","3.22.5","3.23.0","3.23.1","3.24.0","3.25.0","3.25.1","3.25.2","3.25.3","3.25.4","3.25.5","3.25.6","3.26.0","3.26.1","3.26.2","3.26.3","3.26.4","3.26.5","3.27.0","3.28.0","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.4.0","3.4.1","3.4.2","3.4.3","3.5.0","3.5.1","3.5.10","3.5.11","3.5.12","3.5.13","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.7.0","3.7.1","3.7.2","3.7.3","3.8.0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.8.7","3.9.0","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5","3.9.6","3.9.7","3.9.8","4.0.0","4.0.0-BETA1","4.0.0-BETA10","4.0.0-BETA11","4.0.0-BETA12","4.0.0-BETA13","4.0.0-BETA14","4.0.0-BETA15","4.0.0-BETA2","4.0.0-BETA3","4.0.0-BETA4","4.0.0-BETA5","4.0.0-BETA6","4.0.0-BETA7","4.0.0-BETA8","4.0.0-BETA9","4.0.1","4.0.2"]}],"products":[{"vendor":"pmmp","product":"pocketmine-mp"}],"references":[{"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-j5qg-w9jg-3wg3","tags":["vendor-advisory","advisory","web"]},{"url":"https://github.com/pmmp/PocketMine-MP/commit/4d37b79ff7f9d9452e988387f97919a9a1c4954e","tags":["patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.3-operator-privilege-escalation-via-case-sensitivity","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48006"},{"url":"https://github.com/advisories/GHSA-5mrr-24gh-4jwh"},{"url":"https://github.com/iTXTech/Genisys/issues/1188","tags":["web"]},{"url":"https://github.com/pmmp/PocketMine-MP/blob/4.0.3/changelogs/4.0.md#403","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j5qg-w9jg-3wg3"},{"url":"https://github.com/pmmp/PocketMine-MP","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-48006","title":"PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity","description":"PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.","status":"published","published":"2026-09-06T12:00:22.8Z","modified":"2026-10-08T15:20:52.601Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2021-34876","description":"PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.","status":"published","published":"2026-09-06T12:00:22Z","modified":"2026-10-08T15:20:52Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:32.642438Z"}],"ghsa":[{"id":"GHSA-5mrr-24gh-4jwh","title":"PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator...","description":"PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.","status":"published","published":"2026-09-06T12:30:23Z","modified":"2026-09-06T12:30:30Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T15:11:25.773648Z"},{"id":"GHSA-j5qg-w9jg-3wg3","title":"Inability to de-op players if listed in ops.txt with non-lowercase letters","description":"### Impact\nOriginally reported in iTXTech/Genisys#1188\n\n```txt\nPotterHarry98\npotterharry98\n```\n\n`deop PotterHarry98`\n\nwill remove `potterharry98` from the ops.txt but not `PotterHarry98`.\n\nOperator permissions are checked using `Config-\u003eexists()` with `lowercase=true`, which will result in a match:\nhttps://github.com/pmmp/PocketMine-MP/blob/22bb1ce8e03dba57173debf0415390511d68e045/src/utils/Config.php#L449\n\nThis means that it's possible to make yourself impossible to de-op (using commands) by adding your name to ops.txt with uppercase letters.\n\n### Patches\n4d37b79ff7f9d9452e988387f97919a9a1c4954e\n\n### Workarounds\nThis can be easily addressed by removing the offending lines from ops.txt manually.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [pmmp/PocketMine-MP](https://github.com/pmmp/PocketMine-MP)\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)\n","status":"published","published":"2021-12-16T18:53:57Z","modified":"2023-01-09T05:05:54Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T14:36:11.367194Z"}],"nvd":[{"id":"CVE-2021-48006","description":"PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.","status":"published","published":"2026-09-06T12:17:14.637Z","modified":"2026-10-08T16:16:45.28Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T14:07:09.005706Z"}],"osv":[{"id":"CVE-2021-48006","description":"PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.","status":"published","published":"2026-09-06T12:17:14.637Z","modified":"2026-10-20T10:55:11.883274596Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"GHSA-j5qg-w9jg-3wg3","title":"Inability to de-op players if listed in ops.txt with non-lowercase letters","description":"### Impact\nOriginally reported in iTXTech/Genisys#1188\n\n```txt\nPotterHarry98\npotterharry98\n```\n\n`deop PotterHarry98`\n\nwill remove `potterharry98` from the ops.txt but not `PotterHarry98`.\n\nOperator permissions are checked using `Config-\u003eexists()` with `lowercase=true`, which will result in a match:\nhttps://github.com/pmmp/PocketMine-MP/blob/22bb1ce8e03dba57173debf0415390511d68e045/src/utils/Config.php#L449\n\nThis means that it's possible to make yourself impossible to de-op (using commands) by adding your name to ops.txt with uppercase letters.\n\n### Patches\n4d37b79ff7f9d9452e988387f97919a9a1c4954e\n\n### Workarounds\nThis can be easily addressed by removing the offending lines from ops.txt manually.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [pmmp/PocketMine-MP](https://github.com/pmmp/PocketMine-MP)\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)\n","status":"published","published":"2021-12-16T18:53:57Z","modified":"2026-09-08T12:38:02.941679627Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}