CVE-2021-48006 PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity
Attackers can retain operator privileges after deop command due to case-sensitive matching failure in PocketMine-MP server software.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-48006?
CVE-2021-48006 is a medium-severity vulnerability in pmmp PocketMine-MP, published on 6 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.
Weakness: CWE-178
Which versions are affected by CVE-2021-48006?
2 open source packages ship an affected version, including pocketmine/pocketmine-mp.
| Package | Affected | Fixed in |
|---|---|---|
pocketmine/pocketmine-mp Packagist | All versions | 4.0.3 |
pocketmine/pocketmine-mp Packagist | All versions | 4.0.3 |
How do I fix CVE-2021-48006?
Upgrade pocketmine/pocketmine-mp to 4.0.3 or later.
Is CVE-2021-48006 being exploited?
There is no known exploitation of CVE-2021-48006 in the wild and no public exploit code.
Sources
Also known as GHSA-5mrr-24gh-4jwh, GHSA-j5qg-w9jg-3wg3.