CVE-2021-48006: Pmmp Pocketmine-Mp

Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days.

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.

Affected products

• Pmmp Pocketmine-Mp: before 4.0.3 (fixed in 4.0.3)

Published 2026-09-06. Last modified 2026-10-08.